Instruction: List the MITRE techniques contained in the text.

Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown)

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown) ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. ### Response: T1562.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware) ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also tamper with artifacts deployed and utilized by security tools.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also tamper with artifacts deployed and utilized by security tools. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: Security tools may make dynamic changes to system components in order to maintain visibility into specific events.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Security tools may make dynamic changes to system components in order to maintain visibility into specific events. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls)

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also focus on specific applications such as Sysmon.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also focus on specific applications such as Sysmon. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the “Start” and “Enable” values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging)

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the “Start” and “Enable” values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging) ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: On network devices, adversaries may attempt to skip digital signature verification checks by altering startup configuration files and effectively disabling firmware verification that typically occurs at boot.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)(Citation: Analysis of FG-IR-22-369)

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On network devices, adversaries may attempt to skip digital signature verification checks by altering startup configuration files and effectively disabling firmware verification that typically occurs at boot.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)(Citation: Analysis of FG-IR-22-369) ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)

Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)

Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware) ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018)

Output: T1565.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) ### Response: T1565.002.


Instruction: List the MITRE techniques contained in the text.

Input: By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Output: T1565.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. ### Response: T1565.002.


Instruction: List the MITRE techniques contained in the text.

Input: Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information.

Output: T1565.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. ### Response: T1565.002.


Instruction: List the MITRE techniques contained in the text.

Input: The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary.

Output: T1565.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. ### Response: T1565.002.


Instruction: List the MITRE techniques contained in the text.

Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Output: T1565.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact. ### Response: T1565.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Output: T1565.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making. ### Response: T1565.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may alter application binaries used to display data in order to cause runtime manipulations.

Output: T1565.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may alter application binaries used to display data in order to cause runtime manipulations. ### Response: T1565.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1546/001) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect.

Output: T1565.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1546/001) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect. ### Response: T1565.003.


Instruction: List the MITRE techniques contained in the text.

Input: The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary.

Output: T1565.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. ### Response: T1565.003.


Instruction: List the MITRE techniques contained in the text.

Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Output: T1565.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact. ### Response: T1565.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018)

Output: T1565.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) ### Response: T1565.001.


Instruction: List the MITRE techniques contained in the text.

Input: By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Output: T1565.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making. ### Response: T1565.001.


Instruction: List the MITRE techniques contained in the text.

Input: Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats.

Output: T1565.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. ### Response: T1565.001.


Instruction: List the MITRE techniques contained in the text.

Input: The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary.

Output: T1565.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary. ### Response: T1565.001.


Instruction: List the MITRE techniques contained in the text.

Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Output: T1565.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact. ### Response: T1565.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Output: T1565

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact. ### Response: T1565.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can provide malicious content to an XPC service daemon for local code execution.

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can provide malicious content to an XPC service daemon for local code execution. ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools.

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service C API or the high level NSXPCConnection API in order to handle tasks that require elevated privileges (such as network connections).

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service C API or the high level NSXPCConnection API in order to handle tasks that require elevated privileges (such as network connections). ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services.

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services. ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.(Citation: creatingXPCservices)(Citation: Designing Daemons Apple Dev)

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.(Citation: creatingXPCservices)(Citation: Designing Daemons Apple Dev) ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse XPC services to execute malicious content.

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse XPC services to execute malicious content. ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Requests for malicious execution can be passed through the application's XPC Services handler.(Citation: CVMServer Vuln)(Citation: Learn XPC Exploitation)

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Requests for malicious execution can be passed through the application's XPC Services handler.(Citation: CVMServer Vuln)(Citation: Learn XPC Exploitation) ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: This may also include identifying and abusing improper XPC client validation and/or poor sanitization of input parameters to conduct [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).

Output: T1559.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also include identifying and abusing improper XPC client validation and/or poor sanitization of input parameters to conduct [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068). ### Response: T1559.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands.

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input: DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications.

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input: Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution. ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input: Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE.

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input: Despite being superseded by [Component Object Model](https://attack.mitre.org/techniques/T1559/001), DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys.(Citation: BleepingComputer DDE Disabled in Word Dec 2017)(Citation:

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Despite being superseded by [Component Object Model](https://attack.mitre.org/techniques/T1559/001), DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys.(Citation: BleepingComputer DDE Disabled in Word Dec 2017)(Citation: ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft ADV170021 Dec 2017)(Citation:

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft ADV170021 Dec 2017)(Citation: ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Microsoft DDE Advisory Nov 2017)

Microsoft Office documents can be poisoned with DDE commands, directly or through embedded files, and used to deliver execution via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros.(Citation:

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft DDE Advisory Nov 2017)

Microsoft Office documents can be poisoned with DDE commands, directly or through embedded files, and used to deliver execution via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros.(Citation: ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input: SensePost PS DDE May 2016)(Citation:

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SensePost PS DDE May 2016)(Citation: ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input: Kettle CSV DDE Aug 2014)(Citation:

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kettle CSV DDE Aug 2014)(Citation: ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input: Enigma Reviving DDE Jan 2018)(Citation: SensePost MacroLess DDE Oct 2017)

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Enigma Reviving DDE Jan 2018)(Citation: SensePost MacroLess DDE Oct 2017) ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Similarly, adversaries may infect payloads to execute applications and/or commands on a victim device by way of embedding DDE formulas within a CSV file intended to be opened through a Windows spreadsheet program.(Citation: OWASP CSV Injection)(Citation: CSV Excel Macro Injection )

DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, adversaries may infect payloads to execute applications and/or commands on a victim device by way of embedding DDE formulas within a CSV file intended to be opened through a Windows spreadsheet program.(Citation: OWASP CSV Injection)(Citation: CSV Excel Macro Injection )

DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input: DDE execution can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019)

Output: T1559.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DDE execution can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019) ### Response: T1559.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use the Windows Component Object Model (COM) for local code execution.

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use the Windows Component Object Model (COM) for local code execution. ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input: COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019)

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input: Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM)

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as  [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019)

Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation:

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as  [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019)

Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input: Fireeye Hunting COM June 2019)(Citation:

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Fireeye Hunting COM June 2019)(Citation: ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input: ProjectZero File Write EoP Apr 2018)

Output: T1559.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ProjectZero File Write EoP Apr 2018) ### Response: T1559.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: IPC is typically used by processes to share data, communicate with each other, or synchronize execution.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IPC is typically used by processes to share data, communicate with each other, or synchronize execution. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse IPC to execute arbitrary code or commands.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse IPC to execute arbitrary code or commands. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: [Component Object Model](https://attack.mitre.org/techniques/T1559/001).

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Component Object Model](https://attack.mitre.org/techniques/T1559/001). ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms.

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)

Output: T1559

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019) ### Response: T1559.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may add junk data to protocols used for command and control to make detection more difficult.

Output: T1001.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may add junk data to protocols used for command and control to make detection more difficult. ### Response: T1001.001.


Instruction: List the MITRE techniques contained in the text.

Input: By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic.

Output: T1001.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. ### Response: T1001.001.


Instruction: List the MITRE techniques contained in the text.

Input: Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.

Output: T1001.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples may include appending/prepending data with junk characters or writing junk characters between significant characters. ### Response: T1001.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.

Output: T1001.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. ### Response: T1001.003.


Instruction: List the MITRE techniques contained in the text.

Input: By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.

Output: T1001.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. ### Response: T1001.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity.

Output: T1001.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. ### Response: T1001.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.

Output: T1001.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. ### Response: T1001.002.


Instruction: List the MITRE techniques contained in the text.

Input: Steganographic techniques can be used to hide data in digital messages that are transferred between systems.

Output: T1001.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Steganographic techniques can be used to hide data in digital messages that are transferred between systems. ### Response: T1001.002.


Instruction: List the MITRE techniques contained in the text.

Input: This hidden information can be used for command and control of compromised systems.

Output: T1001.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This hidden information can be used for command and control of compromised systems. ### Response: T1001.002.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.

Output: T1001.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control. ### Response: T1001.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obfuscate command and control traffic to make it more difficult to detect.

Output: T1001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obfuscate command and control traffic to make it more difficult to detect. ### Response: T1001.


Instruction: List the MITRE techniques contained in the text.

Input: Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen.

Output: T1001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. ### Response: T1001.


Instruction: List the MITRE techniques contained in the text.

Input: This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.

Output: T1001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols. ### Response: T1001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search network shares on computers they have compromised to find files of interest.

Output: T1039

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search network shares on computers they have compromised to find files of interest. ### Response: T1039.


Instruction: List the MITRE techniques contained in the text.

Input: Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration.

Output: T1039

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. ### Response: T1039.


Instruction: List the MITRE techniques contained in the text.

Input: Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.

Output: T1039

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information. ### Response: T1039.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise third-party infrastructure that can be used during targeting.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise third-party infrastructure that can be used during targeting. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation:

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation:

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Use of compromised infrastructure allows adversaries to stage, launch, and execute operations.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Phishing](https://attack.mitre.org/techniques/T1566) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: campaigns.(Citation: FireEye DNS Hijack 2019)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: campaigns.(Citation: FireEye DNS Hijack 2019) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise access to third-party web services that can be used during targeting.

Output: T1584.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise access to third-party web services that can be used during targeting. ### Response: T1584.006.


Instruction: List the MITRE techniques contained in the text.

Input: A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc.

Output: T1584.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. ### Response: T1584.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations.

Output: T1584.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. ### Response: T1584.006.


Instruction: List the MITRE techniques contained in the text.

Input: Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)),

Output: T1584.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), ### Response: T1584.006.


Instruction: List the MITRE techniques contained in the text.

Input: [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Recorded Future Turla Infra 2020) Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.

Output: T1584.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Recorded Future Turla Infra 2020) Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. ### Response: T1584.006.


Instruction: List the MITRE techniques contained in the text.

Input: By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them.

Output: T1584.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. ### Response: T1584.006.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.

Output: T1584.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains. ### Response: T1584.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install an older version of the operating system of a network device to weaken security.

Output: T1601.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install an older version of the operating system of a network device to weaken security. ### Response: T1601.002.


Instruction: List the MITRE techniques contained in the text.

Input: Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features.

Output: T1601.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. ### Response: T1601.002.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Cisco Synful Knock Evolution)

On embedded devices, downgrading the version typically only requires replacing the operating system file in storage.

Output: T1601.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Cisco Synful Knock Evolution)

On embedded devices, downgrading the version typically only requires replacing the operating system file in storage. ### Response: T1601.002.


Instruction: List the MITRE techniques contained in the text.

Input: With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart.

Output: T1601.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart. ### Response: T1601.002.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts.

Output: T1601.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts. ### Response: T1601.002.


Instruction: List the MITRE techniques contained in the text.

Input: Downgrading the system image to an older versions may allow an adversary to evade defenses by enabling behaviors such as [Weaken Encryption](https://attack.mitre.org/techniques/T1600).

Output: T1601.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Downgrading the system image to an older versions may allow an adversary to evade defenses by enabling behaviors such as [Weaken Encryption](https://attack.mitre.org/techniques/T1600). ### Response: T1601.002.


Instruction: List the MITRE techniques contained in the text.

Input: Downgrading of a system image can be done on its own, or it can be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001).

Output: T1601.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Downgrading of a system image can be done on its own, or it can be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001). ### Response: T1601.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits)

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: To change the operating system in storage, the adversary will typically use the standard procedures available to device operators.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To change the operating system in storage, the adversary will typically use the standard procedures available to device operators. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: To change the operating system in memory, the adversary typically can use one of two methods.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To change the operating system in memory, the adversary typically can use one of two methods. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: This method typically requires administrative level access to the device.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This method typically requires administrative level access to the device. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: In the second method for changing the operating system in memory, the adversary would make use of the boot loader.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the second method for changing the operating system in memory, the adversary would make use of the boot loader. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary, allowing them to patch the live operating system during runtime.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary, allowing them to patch the live operating system during runtime. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: By modifying the instructions stored in the system image file, adversaries may either weaken existing defenses or provision new capabilities that the device did not have before.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By modifying the instructions stored in the system image file, adversaries may either weaken existing defenses or provision new capabilities that the device did not have before. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Examples of existing defenses that can be impeded include encryption, via [Weaken Encryption](https://attack.mitre.org/techniques/T1600), authentication, via [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004), and perimeter defenses, via [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599).

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples of existing defenses that can be impeded include encryption, via [Weaken Encryption](https://attack.mitre.org/techniques/T1600), authentication, via [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004), and perimeter defenses, via [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599). ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adding new capabilities for the adversary’s purpose include [Keylogging](https://attack.mitre.org/techniques/T1056/001),

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adding new capabilities for the adversary’s purpose include [Keylogging](https://attack.mitre.org/techniques/T1056/001), ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003), and [Port Knocking](https://attack.mitre.org/techniques/T1205/001).

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003), and [Port Knocking](https://attack.mitre.org/techniques/T1205/001). ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also compromise existing commands in the operating system to produce false output to mislead defenders.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also compromise existing commands in the operating system to produce false output to mislead defenders. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: When this method is used in conjunction with [Downgrade System Image](https://attack.mitre.org/techniques/T1601/002), one example of a compromised system command may include changing the output of the command that shows the version of the currently running operating system.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When this method is used in conjunction with [Downgrade System Image](https://attack.mitre.org/techniques/T1601/002), one example of a compromised system command may include changing the output of the command that shows the version of the currently running operating system. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: By patching the operating system, the adversary can change this command to instead display the original, higher revision number that they replaced through the system downgrade.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By patching the operating system, the adversary can change this command to instead display the original, higher revision number that they replaced through the system downgrade. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: When the operating system is patched in storage, this can be achieved in either the resident storage (typically a form of flash memory, which is non-volatile) or via [TFTP Boot](https://attack.mitre.org/techniques/T1542/005).

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the operating system is patched in storage, this can be achieved in either the resident storage (typically a form of flash memory, which is non-volatile) or via [TFTP Boot](https://attack.mitre.org/techniques/T1542/005). ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: When the technique is performed on the running operating system in memory and not on the stored copy, this technique will not survive across reboots.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the technique is performed on the running operating system in memory and not on the stored copy, this technique will not survive across reboots. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: However, live memory modification of the operating system can be combined with [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) to achieve persistence.

Output: T1601.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, live memory modification of the operating system can be combined with [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) to achieve persistence. ### Response: T1601.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.

Output: T1601

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. ### Response: T1601.


Instruction: List the MITRE techniques contained in the text.

Input: On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.

Output: T1601

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. ### Response: T1601.


Instruction: List the MITRE techniques contained in the text.

Input: To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it.

Output: T1601

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. ### Response: T1601.


Instruction: List the MITRE techniques contained in the text.

Input: This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.

Output: T1601

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device. ### Response: T1601.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the binaries used by services.

Output: T1574.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the binaries used by services. ### Response: T1574.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start.

Output: T1574.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. ### Response: T1574.010.


Instruction: List the MITRE techniques contained in the text.

Input: These service processes may automatically execute specific binaries as part of their functionality or to perform other actions.

Output: T1574.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. ### Response: T1574.010.


Instruction: List the MITRE techniques contained in the text.

Input: If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process.

Output: T1574.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. ### Response: T1574.010.


Instruction: List the MITRE techniques contained in the text.

Input: If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

Output: T1574.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM. ### Response: T1574.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level.

Output: T1574.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. ### Response: T1574.010.


Instruction: List the MITRE techniques contained in the text.

Input: If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.

Output: T1574.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence. ### Response: T1574.010.