Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send phishing messages to gain access to victim systems.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send phishing messages to gain access to victim systems. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of phishing are electronically delivered social engineering.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of phishing are electronically delivered social engineering. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing can be targeted, known as spearphishing.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing can be targeted, known as spearphishing. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing may also be conducted via third-party services, like social media platforms.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing may also be conducted via third-party services, like social media platforms. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Palo Alto Unit 42 VBA Infostealer 2014)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Palo Alto Unit 42 VBA Infostealer 2014) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Unit42 Luna Moth)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit42 Luna Moth) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: **This technique has been deprecated.

Output: T1061

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **This technique has been deprecated. ### Response: T1061.


Instruction: List the MITRE techniques contained in the text.

Input: Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.

Output: T1061

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate. ### Response: T1061.


Instruction: List the MITRE techniques contained in the text.

Input:
**

The Graphical User Interfaces (GUI) is a common way to interact with an operating system.

Output: T1061

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **

The Graphical User Interfaces (GUI) is a common way to interact with an operating system. ### Response: T1061.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use a system's GUI during an operation, commonly through a remote interactive session such as [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076), instead of through a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), to search for information and execute files via mouse double-click events, the Windows Run command (Citation: Wikipedia Run Command), or other potentially difficult to monitor interactions.

Output: T1061

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use a system's GUI during an operation, commonly through a remote interactive session such as [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1076), instead of through a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), to search for information and execute files via mouse double-click events, the Windows Run command (Citation: Wikipedia Run Command), or other potentially difficult to monitor interactions. ### Response: T1061.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: During the booting process of a computer, firmware and various startup services are loaded before the operating system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During the booting process of a computer, firmware and various startup services are loaded before the operating system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting)

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect.

Output: T1542.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. ### Response: T1542.004.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks)

ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset.

Output: T1542.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks)

ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. ### Response: T1542.004.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image.

Output: T1542.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. ### Response: T1542.004.


Instruction: List the MITRE techniques contained in the text.

Input: This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.

Output: T1542.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect. ### Response: T1542.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code.

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: CHM files are commonly distributed as part of the Microsoft HTML Help system.

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CHM files are commonly distributed as part of the Microsoft HTML Help system. ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018)

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe).

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft HTML Help Executable Program)

A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft HTML Help Executable Program)

A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe.

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017) ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This may compromise the integrity of security solutions by causing notable events to go unreported.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may compromise the integrity of security solutions by causing notable events to go unreported. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

Output: T1070.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. ### Response: T1070.005.


Instruction: List the MITRE techniques contained in the text.

Input: Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed.

Output: T1070.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. ### Response: T1070.005.


Instruction: List the MITRE techniques contained in the text.

Input: [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command.

Output: T1070.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. ### Response: T1070.005.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Technet Net Use)

Output: T1070.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Technet Net Use) ### Response: T1070.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

Output: T1090

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. ### Response: T1090.


Instruction: List the MITRE techniques contained in the text.

Input: Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.

Output: T1090

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. ### Response: T1090.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion.

Output: T1090

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. ### Response: T1090.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Output: T1090

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. ### Response: T1090.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

Output: T1090

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic. ### Response: T1090.


Instruction: List the MITRE techniques contained in the text.

Input: To disguise the source of malicious traffic, adversaries may chain together multiple proxies.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To disguise the source of malicious traffic, adversaries may chain together multiple proxies. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Onion Routing)

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Onion Routing) ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: In the case of network infrastructure, particularly routers, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain within the Wide-Area Network (WAN) of the enterprise.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the case of network infrastructure, particularly routers, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain within the Wide-Area Network (WAN) of the enterprise. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001), adversaries can add custom code to the affected network devices that will implement onion routing between those nodes.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001), adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: This custom onion routing network will transport the encrypted C2 traffic through the compromised population, allowing adversaries to communicate with any device within the onion routing network.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This custom onion routing network will transport the encrypted C2 traffic through the compromised population, allowing adversaries to communicate with any device within the onion routing network. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method in order to allow the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s WAN.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method in order to allow the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s WAN. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: Protocols such as ICMP may be used as a transport.

Output: T1090.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Protocols such as ICMP may be used as a transport. ### Response: T1090.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap.

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input: Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed.

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input: The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts. ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input: Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies.

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input: Typically, management services over commonly used ports are used when stuffing credentials.

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically, management services over commonly used ports are used when stuffing credentials. ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Commonly targeted services include the following:

* SSH (22/TCP)
*

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commonly targeted services include the following:

* SSH (22/TCP)
* ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Telnet (23/TCP)
* FTP (21/TCP)

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Telnet (23/TCP)
* FTP (21/TCP) ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input:
* NetBIOS / SMB / Samba (139/TCP & 445/TCP)
* LDAP (389/TCP)
*

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * NetBIOS / SMB / Samba (139/TCP & 445/TCP)
* LDAP (389/TCP)
* ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Kerberos (88/TCP)
* RDP / Terminal Services (3389/TCP)
* HTTP/HTTP Management Services (80/TCP & 443/TCP)
* MSSQL (1433/TCP)
*

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos (88/TCP)
* RDP / Terminal Services (3389/TCP)
* HTTP/HTTP Management Services (80/TCP & 443/TCP)
* MSSQL (1433/TCP)
* ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Oracle (1521/TCP)
* MySQL (3306/TCP)
* VNC (5900/TCP)

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Oracle (1521/TCP)
* MySQL (3306/TCP)
* VNC (5900/TCP) ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)

Output: T1110.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018) ### Response: T1110.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input: [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option.

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option. ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input: Further,  adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation:

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Further,  adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation: ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input:
US-CERT-TA18-106A)

Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes.

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: US-CERT-TA18-106A)

Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input: Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking)

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking) ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input: The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.

Output: T1110.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access. ### Response: T1110.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input: Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords.

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input: Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts. ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input: Guessing passwords can be a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies.

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Guessing passwords can be a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Cylance Cleaver)

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cylance Cleaver) ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input: Typically, management services over commonly used ports are used when guessing passwords.

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically, management services over commonly used ports are used when guessing passwords. ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Commonly targeted services include the following:

* SSH (22/TCP)
*

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commonly targeted services include the following:

* SSH (22/TCP)
* ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Telnet (23/TCP)
* FTP (21/TCP)

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Telnet (23/TCP)
* FTP (21/TCP) ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input:
* NetBIOS / SMB / Samba (139/TCP & 445/TCP)
* LDAP (389/TCP)
*

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * NetBIOS / SMB / Samba (139/TCP & 445/TCP)
* LDAP (389/TCP)
* ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Kerberos (88/TCP)
* RDP / Terminal Services (3389/TCP)
* HTTP/HTTP Management Services (80/TCP & 443/TCP)
* MSSQL (1433/TCP)
*

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos (88/TCP)
* RDP / Terminal Services (3389/TCP)
* HTTP/HTTP Management Services (80/TCP & 443/TCP)
* MSSQL (1433/TCP)
* ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Oracle (1521/TCP)
* MySQL (3306/TCP)
* VNC (5900/TCP)
* SNMP (161/UDP and 162/TCP/UDP)

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Oracle (1521/TCP)
* MySQL (3306/TCP)
* VNC (5900/TCP)
* SNMP (161/UDP and 162/TCP/UDP) ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018).

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018). ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input: Further, adversaries may abuse network device interfaces (such as `wlanAPI`) to brute force accessible wifi-router(s) via wireless authentication protocols.(Citation:

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Further, adversaries may abuse network device interfaces (such as `wlanAPI`) to brute force accessible wifi-router(s) via wireless authentication protocols.(Citation: ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input: Trend Micro Emotet 2020)

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Trend Micro Emotet 2020) ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input: In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625.

Output: T1110.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625. ### Response: T1110.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials.

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input: Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain.

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input: Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: BlackHillsInfosec

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: BlackHillsInfosec ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input: Password Spraying)

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Password Spraying) ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input: Typically, management services over commonly used ports are used when password spraying.

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically, management services over commonly used ports are used when password spraying. ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Commonly targeted services include the following:

* SSH (22/TCP)
*

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commonly targeted services include the following:

* SSH (22/TCP)
* ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Telnet (23/TCP)
* FTP (21/TCP)

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Telnet (23/TCP)
* FTP (21/TCP) ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input:
* NetBIOS / SMB / Samba (139/TCP & 445/TCP)
* LDAP (389/TCP)
*

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * NetBIOS / SMB / Samba (139/TCP & 445/TCP)
* LDAP (389/TCP)
* ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Kerberos (88/TCP)
* RDP / Terminal Services (3389/TCP)
* HTTP/HTTP Management Services (80/TCP & 443/TCP)
* MSSQL (1433/TCP)
*

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos (88/TCP)
* RDP / Terminal Services (3389/TCP)
* HTTP/HTTP Management Services (80/TCP & 443/TCP)
* MSSQL (1433/TCP)
* ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Oracle (1521/TCP)
* MySQL (3306/TCP)
* VNC (5900/TCP)

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Oracle (1521/TCP)
* MySQL (3306/TCP)
* VNC (5900/TCP) ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018)

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018) ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input: In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625.

Output: T1110.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625. ### Response: T1110.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: Brute forcing credentials may take place at various points during a breach.

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Brute forcing credentials may take place at various points during a breach. ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201).

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access.

Output: T1110

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. ### Response: T1110.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005). ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Powershell Remote Commands)(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Powershell Remote Commands)(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Cisco IOS Software Integrity Assurance - Command History)(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cisco IOS Software Integrity Assurance - Command History)(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Remote Shell Execution in Python)

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote Shell Execution in Python) ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Unix shell commands and scripts for execution.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Unix shell commands and scripts for execution. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.)

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell)

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Unix shells to execute various commands or payloads.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Unix shells to execute various commands or payloads. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004).

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.

Output: T1059.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence. ### Response: T1059.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage Microsoft Office-based applications for persistence between startups.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage Microsoft Office-based applications for persistence between startups. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation:

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: SensePost Ruler GitHub)

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SensePost Ruler GitHub) ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: These persistence mechanisms can work within Outlook or be used through Office 365.(Citation:

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet O365 Outlook Rules)

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet O365 Outlook Rules) ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system.

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: Outlook forms are used as templates for presentation and functionality in Outlook messages.

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Outlook forms are used as templates for presentation and functionality in Outlook messages. ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation:

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: SensePost Outlook Forms)

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SensePost Outlook Forms) ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started.

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started. ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms)

Output: T1137.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious forms will execute when an adversary sends a specifically crafted email to the user.(Citation: SensePost Outlook Forms) ### Response: T1137.003.


Instruction: List the MITRE techniques contained in the text.

Input: macOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths.

Output: T1157

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: macOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths. ### Response: T1157.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can take advantage of ambiguous paths to plant dylibs to gain privilege escalation or persistence.

Output: T1157

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can take advantage of ambiguous paths to plant dylibs to gain privilege escalation or persistence. ### Response: T1157.


Instruction: List the MITRE techniques contained in the text.

Input: A common method is to see what dylibs an application uses, then plant a malicious version with the same name higher up in the search path.

Output: T1157

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A common method is to see what dylibs an application uses, then plant a malicious version with the same name higher up in the search path. ### Response: T1157.


Instruction: List the MITRE techniques contained in the text.

Input: This typically results in the dylib being in the same folder as the application itself.

Output: T1157

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This typically results in the dylib being in the same folder as the application itself. ### Response: T1157.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Writing Bad Malware for OSX)

Output: T1157

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Writing Bad Malware for OSX) ### Response: T1157.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Malware Persistence on OS X)

Output: T1157

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Malware Persistence on OS X) ### Response: T1157.


Instruction: List the MITRE techniques contained in the text.

Input: If the program is configured to run at a higher privilege level than the current user, then when the dylib is loaded into the application, the dylib will also run at that elevated level.

Output: T1157

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the program is configured to run at a higher privilege level than the current user, then when the dylib is loaded into the application, the dylib will also run at that elevated level. ### Response: T1157.


Instruction: List the MITRE techniques contained in the text.

Input: This can be used by adversaries as a privilege escalation technique.

Output: T1157

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be used by adversaries as a privilege escalation technique. ### Response: T1157.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down. ### Response: T1562.