Instruction: List the MITRE techniques contained in the text.

Input: adversaries may access the contents/objects stored in cloud infrastructure.

Output: T1619

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: adversaries may access the contents/objects stored in cloud infrastructure. ### Response: T1619.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage.

Output: T1619

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. ### Response: T1619.


Instruction: List the MITRE techniques contained in the text.

Input: Examples include ListObjectsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azure(Citation: List Blobs) .

Output: T1619

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples include ListObjectsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azure(Citation: List Blobs) . ### Response: T1619.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services.

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may generate these credential materials in order to gain access to web resources.

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may generate these credential materials in order to gain access to web resources. ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539),

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users.

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: The generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator)

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator) ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005)), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain.(Citation:

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005)), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain.(Citation: ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: AWS Temporary Security Credentials)(Citation: Zimbra Preauth)

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AWS Temporary Security Credentials)(Citation: Zimbra Preauth) ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Once forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation:

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation:

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation: ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft SolarWinds Customer Guidance)

Output: T1606

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft SolarWinds Customer Guidance) ### Response: T1606.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.

Output: T1606.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. ### Response: T1606.001.


Instruction: List the MITRE techniques contained in the text.

Input: Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access.

Output: T1606.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access. ### Response: T1606.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may generate these cookies in order to gain access to web resources.

Output: T1606.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may generate these cookies in order to gain access to web resources. ### Response: T1606.001.


Instruction: List the MITRE techniques contained in the text.

Input: This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539) and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users.

Output: T1606.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539) and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users. ### Response: T1606.001.


Instruction: List the MITRE techniques contained in the text.

Input: Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces.(Citation:

Output: T1606.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces.(Citation: ### Response: T1606.001.


Instruction: List the MITRE techniques contained in the text.

Input: Pass The Cookie)

Output: T1606.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Pass The Cookie) ### Response: T1606.001.


Instruction: List the MITRE techniques contained in the text.

Input: The generation of web cookies often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.

Output: T1606.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The generation of web cookies often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values. ### Response: T1606.001.


Instruction: List the MITRE techniques contained in the text.

Input: Once forged, adversaries may use these web cookies to access resources ([Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Volexity SolarWinds)(Citation:

Output: T1606.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once forged, adversaries may use these web cookies to access resources ([Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Volexity SolarWinds)(Citation: ### Response: T1606.001.


Instruction: List the MITRE techniques contained in the text.

Input: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)

Output: T1606.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019) ### Response: T1606.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may enumerate system and service logs to find useful data.

Output: T1654

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may enumerate system and service logs to find useful data. ### Response: T1654.


Instruction: List the MITRE techniques contained in the text.

Input: These logs may highlight various types of valuable insights for an adversary, such as user authentication records ([Account Discovery](https://attack.mitre.org/techniques/T1087)), security or vulnerable software ([Software Discovery](https://attack.mitre.org/techniques/T1518)), or hosts within a compromised network ([Remote System Discovery](https://attack.mitre.org/techniques/T1018)).

Output: T1654

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These logs may highlight various types of valuable insights for an adversary, such as user authentication records ([Account Discovery](https://attack.mitre.org/techniques/T1087)), security or vulnerable software ([Software Discovery](https://attack.mitre.org/techniques/T1518)), or hosts within a compromised network ([Remote System Discovery](https://attack.mitre.org/techniques/T1018)). ### Response: T1654.


Instruction: List the MITRE techniques contained in the text.

Input: Host binaries may be leveraged to collect system logs.

Output: T1654

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Host binaries may be leveraged to collect system logs. ### Response: T1654.


Instruction: List the MITRE techniques contained in the text.

Input: Examples include using `wevtutil.exe` or [PowerShell](https://attack.mitre.org/techniques/T1059/001) on Windows to access and/or export security event information.(Citation: WithSecure Lazarus-NoPineapple Threat Intel Report 2023)(Citation: Cadet Blizzard emerges as novel threat actor)

Output: T1654

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples include using `wevtutil.exe` or [PowerShell](https://attack.mitre.org/techniques/T1059/001) on Windows to access and/or export security event information.(Citation: WithSecure Lazarus-NoPineapple Threat Intel Report 2023)(Citation: Cadet Blizzard emerges as novel threat actor) ### Response: T1654.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s `CollectGuestLogs.exe` to collect security logs from cloud hosted infrastructure.(Citation: SIM Swapping and Abuse of the Microsoft Azure Serial Console)

Output: T1654

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s `CollectGuestLogs.exe` to collect security logs from cloud hosted infrastructure.(Citation: SIM Swapping and Abuse of the Microsoft Azure Serial Console) ### Response: T1654.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also target centralized logging infrastructure such as SIEMs.

Output: T1654

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also target centralized logging infrastructure such as SIEMs. ### Response: T1654.


Instruction: List the MITRE techniques contained in the text.

Input: Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis.

Output: T1654

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis. ### Response: T1654.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: Windows uses access tokens to determine the ownership of a running process.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows uses access tokens to determine the ownership of a running process. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: When this occurs, the process also takes on the security context associated with the new token.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When this occurs, the process also takes on the security context associated with the new token. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)).

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary must already be in a privileged user context (i.e. administrator) to steal a token.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary must already be in a privileged user context (i.e. administrator) to steal a token. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input:
An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)

Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)

Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, this may be useful for when the target user has a non-network logon session on the system.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, this may be useful for when the target user has a non-network logon session on the system. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Firewall rules may also already exist to permit traffic to these services.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Firewall rules may also already exist to permit traffic to these services. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel.

Output: T1567.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. ### Response: T1567.001.


Instruction: List the MITRE techniques contained in the text.

Input: Code repositories are often accessible via an API (ex: https://api.github.com).

Output: T1567.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code repositories are often accessible via an API (ex: https://api.github.com). ### Response: T1567.001.


Instruction: List the MITRE techniques contained in the text.

Input: Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.

Output: T1567.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. ### Response: T1567.001.


Instruction: List the MITRE techniques contained in the text.

Input: Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.

Output: T1567.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network. ### Response: T1567.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary may then perform actions as the logged-on user.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary may then perform actions as the logged-on user. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: In an enterprise environment, servers and workstations can be organized into domains.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In an enterprise environment, servers and workstations can be organized into domains. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Remote Management MDM macOS)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote Management MDM macOS)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Kickstart Apple Remote Desktop commands)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kickstart Apple Remote Desktop commands)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Apple Remote Desktop Admin Guide 3.3)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple Remote Desktop Admin Guide 3.3) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement.

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Lockboxx ARD 2019)(Citation:

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Lockboxx ARD 2019)(Citation: ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Kickstart Apple Remote Desktop commands)

Output: T1021

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kickstart Apple Remote Desktop commands) ### Response: T1021.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities.

Output: T1021.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. ### Response: T1021.007.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary may then perform management actions or access cloud-hosted resources as the logged-on user.

Output: T1021.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. ### Response: T1021.007.


Instruction: List the MITRE techniques contained in the text.

Input: Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane.

Output: T1021.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. ### Response: T1021.007.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI.

Output: T1021.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI. ### Response: T1021.007.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password.

Output: T1021.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password. ### Response: T1021.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s). ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: The observation of the signal packets to trigger the communication can be conducted through different methods.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The observation of the signal packets to trigger the communication can be conducted through different methods. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also attempt to connect to a router interface, broadcast, and network address IP on the same port in order to achieve their goals and objectives.(Citation:

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also attempt to connect to a router interface, broadcast, and network address IP on the same port in order to achieve their goals and objectives.(Citation: ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Cisco Synful Knock Evolution)(Citation: Mandiant - Synful Knock)(Citation: Cisco Blog Legacy Device Attacks)

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cisco Synful Knock Evolution)(Citation: Mandiant - Synful Knock)(Citation: Cisco Blog Legacy Device Attacks) ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use the Wake-on-LAN feature to turn on powered off systems.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use the Wake-on-LAN feature to turn on powered off systems. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it.

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it. ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Once the system is powered on, it may become a target for lateral movement.(Citation: Bleeping Computer - Ryuk WoL)(Citation: AMD Magic Packet)

Output: T1205

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once the system is powered on, it may become a target for lateral movement.(Citation: Bleeping Computer - Ryuk WoL)(Citation: AMD Magic Packet) ### Response: T1205.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use port knocking to hide open ports used for persistence or command and control.

Output: T1205.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use port knocking to hide open ports used for persistence or command and control. ### Response: T1205.001.


Instruction: List the MITRE techniques contained in the text.

Input: To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports.

Output: T1205.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. ### Response: T1205.001.


Instruction: List the MITRE techniques contained in the text.

Input: After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.

Output: T1205.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. ### Response: T1205.001.


Instruction: List the MITRE techniques contained in the text.

Input: This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system.

Output: T1205.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. ### Response: T1205.001.


Instruction: List the MITRE techniques contained in the text.

Input: The observation of the signal packets to trigger the communication can be conducted through different methods.

Output: T1205.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The observation of the signal packets to trigger the communication can be conducted through different methods. ### Response: T1205.001.


Instruction: List the MITRE techniques contained in the text.

Input: One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question.

Output: T1205.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. ### Response: T1205.001.


Instruction: List the MITRE techniques contained in the text.

Input: Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.

Output: T1205.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs. ### Response: T1205.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: This is common behavior that can be used across different platforms and the network to evade defenses.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is common behavior that can be used across different platforms and the network to evade defenses. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may be compressed, archived, or encrypted in order to avoid detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may be compressed, archived, or encrypted in order to avoid detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: These payloads may be used during Initial Access or later to mitigate detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These payloads may be used during Initial Access or later to mitigate detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Volexity PowerDuke November 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Volexity PowerDuke November 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use compressed or archived scripts, such as JavaScript.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use compressed or archived scripts, such as JavaScript. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Linux/Cdorked.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Linux/Cdorked. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: A We Live Security Analysis)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A We Live Security Analysis) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Carbon Black Obfuscation Sept 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Carbon Black Obfuscation Sept 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Obfuscation June 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Obfuscation June 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse this LNK metadata to download malicious payloads.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse this LNK metadata to download malicious payloads. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries have been observed using LNK files as phishing payloads to deliver malware.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries have been observed using LNK files as phishing payloads to deliver malware. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: Once invoked (e.g., [Malicious File](https://attack.mitre.org/techniques/T1204/002)), payloads referenced via external URLs within the LNK icon location field may be downloaded.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once invoked (e.g., [Malicious File](https://attack.mitre.org/techniques/T1204/002)), payloads referenced via external URLs within the LNK icon location field may be downloaded. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: These files may also then be invoked by [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)/[System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218) arguments within the target path field of the LNK.(Citation:

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These files may also then be invoked by [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)/[System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218) arguments within the target path field of the LNK.(Citation: ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input:
Unprotect Shortcut)(Citation: Booby Trap Shortcut 2017)

LNK Icon Smuggling may also be utilized post compromise, such as malicious scripts executing an LNK on an infected host to download additional malicious payloads.

Output: T1027.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unprotect Shortcut)(Citation: Booby Trap Shortcut 2017)

LNK Icon Smuggling may also be utilized post compromise, such as malicious scripts executing an LNK on an infected host to download additional malicious payloads. ### Response: T1027.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy, lease, or rent infrastructure that can be used during targeting.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy, lease, or rent infrastructure that can be used during targeting. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: A wide variety of infrastructure exists for hosting and orchestrating adversary operations.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A wide variety of infrastructure exists for hosting and orchestrating adversary operations. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation:

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT29 Microsoft 365 2022)

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT29 Microsoft 365 2022) ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may register for web services that can be used during targeting.

Output: T1583.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may register for web services that can be used during targeting. ### Response: T1583.006.


Instruction: List the MITRE techniques contained in the text.

Input: A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)),

Output: T1583.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), ### Response: T1583.006.


Instruction: List the MITRE techniques contained in the text.

Input: [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566).

Output: T1583.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). ### Response: T1583.006.


Instruction: List the MITRE techniques contained in the text.

Input: Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.

Output: T1583.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. ### Response: T1583.006.


Instruction: List the MITRE techniques contained in the text.

Input: By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.

Output: T1583.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By utilizing a web service, adversaries can make it difficult to physically tie back operations to them. ### Response: T1583.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019)

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: OAuth is one commonly implemented framework that issues tokens to users for access to systems.

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: OAuth is one commonly implemented framework that issues tokens to users for access to systems. ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment.

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: In Kubernetes environments, processes running inside a container communicate with the Kubernetes API server using service account tokens.

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Kubernetes environments, processes running inside a container communicate with the Kubernetes API server using service account tokens. ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: If a container is compromised, an attacker may be able to steal the container’s token and thereby gain access to Kubernetes API commands.(Citation:

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If a container is compromised, an attacker may be able to steal the container’s token and thereby gain access to Kubernetes API commands.(Citation: ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input:
Kubernetes Service Accounts)

Token theft can also occur through social engineering, in which case user action may be required to grant access.

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kubernetes Service Accounts)

Token theft can also occur through social engineering, in which case user action may be required to grant access. ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols.

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: An example commonly-used sequence is Microsoft's Authorization Code Grant flow.(Citation: Microsoft Identity Platform Protocols May 2019)(Citation: Microsoft - OAuth Code Authorization flow - June 2019)

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An example commonly-used sequence is Microsoft's Authorization Code Grant flow.(Citation: Microsoft Identity Platform Protocols May 2019)(Citation: Microsoft - OAuth Code Authorization flow - June 2019) ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials.

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token.(Citation: Amnesty OAuth Phishing Attacks, August 2019)(Citation:

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token.(Citation: Amnesty OAuth Phishing Attacks, August 2019)(Citation: ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: Trend Micro Pawn Storm OAuth 2017)

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Trend Micro Pawn Storm OAuth 2017) ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls.(Citation: Microsoft - Azure AD App Registration - May 2019)

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls.(Citation: Microsoft - Azure AD App Registration - May 2019) ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: Then, they can send a [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002) to the target user to entice them to grant access to the application.

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Then, they can send a [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002) to the target user to entice them to grant access to the application. ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through [Application Access Token](https://attack.mitre.org/techniques/T1550/001).(Citation: Microsoft - Azure AD Identity Tokens - Aug 2019)

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through [Application Access Token](https://attack.mitre.org/techniques/T1550/001).(Citation: Microsoft - Azure AD Identity Tokens - Aug 2019) ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token.

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. ### Response: T1528.


Instruction: List the MITRE techniques contained in the text.

Input: However, in some cases, adversaries can also steal application refresh tokens(Citation: Auth0 Understanding Refresh Tokens), allowing them to obtain new access tokens without prompting the user.

Output: T1528

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, in some cases, adversaries can also steal application refresh tokens(Citation: Auth0 Understanding Refresh Tokens), allowing them to obtain new access tokens without prompting the user. ### Response: T1528.