Instruction: List the MITRE techniques contained in the text.

Input: Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106).

Output: T1202

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). ### Response: T1202.


Instruction: List the MITRE techniques contained in the text.

Input: For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts.

Output: T1202

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. ### Response: T1202.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)

Output: T1202

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017) ### Response: T1202.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads.

Output: T1202

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads. ### Response: T1202.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use a custom cryptographic protocol or algorithm to hide command and control traffic.

Output: T1024

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use a custom cryptographic protocol or algorithm to hide command and control traffic. ### Response: T1024.


Instruction: List the MITRE techniques contained in the text.

Input: A simple scheme, such as XOR-ing the plaintext with a fixed key, will produce a very weak ciphertext.

Output: T1024

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A simple scheme, such as XOR-ing the plaintext with a fixed key, will produce a very weak ciphertext. ### Response: T1024.


Instruction: List the MITRE techniques contained in the text.

Input: Custom encryption schemes may vary in sophistication.

Output: T1024

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Custom encryption schemes may vary in sophistication. ### Response: T1024.


Instruction: List the MITRE techniques contained in the text.

Input: Analysis and reverse engineering of malware samples may be enough to discover the algorithm and encryption key used.

Output: T1024

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Analysis and reverse engineering of malware samples may be enough to discover the algorithm and encryption key used. ### Response: T1024.


Instruction: List the MITRE techniques contained in the text.

Input: Some adversaries may also attempt to implement their own version of a well-known cryptographic algorithm instead of using a known implementation library, which may lead to unintentional errors.

Output: T1024

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some adversaries may also attempt to implement their own version of a well-known cryptographic algorithm instead of using a known implementation library, which may lead to unintentional errors. ### Response: T1024.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: F-Secure Cosmicduke)

Output: T1024

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: F-Secure Cosmicduke) ### Response: T1024.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence.

Output: T1536

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. ### Response: T1536.


Instruction: List the MITRE techniques contained in the text.

Input: In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.

Output: T1536

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs. ### Response: T1536.


Instruction: List the MITRE techniques contained in the text.

Input: Another variation of this technique is to utilize temporary storage attached to the compute instance.

Output: T1536

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another variation of this technique is to utilize temporary storage attached to the compute instance. ### Response: T1536.


Instruction: List the MITRE techniques contained in the text.

Input: Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)

Output: T1536

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot) ### Response: T1536.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.

Output: T1091

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. ### Response: T1091.


Instruction: List the MITRE techniques contained in the text.

Input: In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system.

Output: T1091

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. ### Response: T1091.


Instruction: List the MITRE techniques contained in the text.

Input: In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.

Output: T1091

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself. ### Response: T1091.


Instruction: List the MITRE techniques contained in the text.

Input: Mobile devices may also be used to infect PCs with malware if connected via USB.(Citation:

Output: T1091

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mobile devices may also be used to infect PCs with malware if connected via USB.(Citation: ### Response: T1091.


Instruction: List the MITRE techniques contained in the text.

Input: Exploiting Smartphone USB )

Output: T1091

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Exploiting Smartphone USB ) ### Response: T1091.


Instruction: List the MITRE techniques contained in the text.

Input: This infection may be achieved using devices (Android, iOS, etc.)

Output: T1091

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This infection may be achieved using devices (Android, iOS, etc.) ### Response: T1091.


Instruction: List the MITRE techniques contained in the text.

Input: and, in some instances, USB charging cables.(Citation: Windows Malware Infecting Android)(Citation:

Output: T1091

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: and, in some instances, USB charging cables.(Citation: Windows Malware Infecting Android)(Citation: ### Response: T1091.


Instruction: List the MITRE techniques contained in the text.

Input: iPhone Charging Cable Hack)

Output: T1091

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: iPhone Charging Cable Hack) ### Response: T1091.


Instruction: List the MITRE techniques contained in the text.

Input: For example, when a smartphone is connected to a system, it may appear to be mounted similar to a USB-connected disk drive.

Output: T1091

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, when a smartphone is connected to a system, it may appear to be mounted similar to a USB-connected disk drive. ### Response: T1091.


Instruction: List the MITRE techniques contained in the text.

Input: If malware that is compatible with the connected system is on the mobile device, the malware could infect the machine (especially if Autorun features are enabled).

Output: T1091

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If malware that is compatible with the connected system is on the mobile device, the malware could infect the machine (especially if Autorun features are enabled). ### Response: T1091.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.

Output: T1005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration. ### Response: T1005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco)

Output: T1005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) ### Response: T1005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.

Output: T1005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system. ### Response: T1005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis.

Output: T1140

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. ### Response: T1140.


Instruction: List the MITRE techniques contained in the text.

Input: They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it.

Output: T1140

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. ### Response: T1140.


Instruction: List the MITRE techniques contained in the text.

Input: Methods for doing that include built-in functionality of malware or by using utilities present on the system.

Output: T1140

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Methods for doing that include built-in functionality of malware or by using utilities present on the system. ### Response: T1140.


Instruction: List the MITRE techniques contained in the text.

Input: One such example is the use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file.(Citation: Malwarebytes Targeted Attack against Saudi Arabia)

Output: T1140

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: One such example is the use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file.(Citation: Malwarebytes Targeted Attack against Saudi Arabia) ### Response: T1140.


Instruction: List the MITRE techniques contained in the text.

Input: Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload.(Citation: Carbon Black Obfuscation Sept 2016)

Output: T1140

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload.(Citation: Carbon Black Obfuscation Sept 2016) ### Response: T1140.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1140

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1140.


Instruction: List the MITRE techniques contained in the text.

Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.

Output: T1140

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. ### Response: T1140.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Volexity PowerDuke November 2016)

Output: T1140

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Volexity PowerDuke November 2016) ### Response: T1140.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage Microsoft Office-based applications for persistence between startups.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage Microsoft Office-based applications for persistence between startups. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins. ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation:

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.(Citation: ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: SensePost Ruler GitHub)

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SensePost Ruler GitHub) ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: These persistence mechanisms can work within Outlook or be used through Office 365.(Citation:

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These persistence mechanisms can work within Outlook or be used through Office 365.(Citation: ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet O365 Outlook Rules)

Output: T1137

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet O365 Outlook Rules) ### Response: T1137.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system.

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: Outlook rules allow a user to define automated behavior to manage email messages.

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Outlook rules allow a user to define automated behavior to manage email messages. ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender.

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules)

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules) ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started.

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started. ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious rules will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules)

Output: T1137.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious rules will execute when an adversary sends a specifically crafted email to the user.(Citation: SilentBreak Outlook Rules) ### Response: T1137.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may impair command history logging to hide commands they run on a compromised system.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may impair command history logging to hide commands they run on a compromised system. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a user logs off a system, this information is flushed to a file in the user's home directory called <code>~/.bash_history</code>. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to "ignorespace".

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to "ignorespace". ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups".

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: This means that “ ls” will not be saved, but “ls” would be saved by history.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This means that “ ls” will not be saved, but “ls” would be saved by history. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: On Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default).

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: This will cause ConsoleHost_history.txt to stop receiving logs.

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This will cause ConsoleHost_history.txt to stop receiving logs. ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, it is possible to turn off logging to this file using the PowerShell command <code>Set-PSReadlineOption -HistorySaveStyle

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, it is possible to turn off logging to this file using the PowerShell command <code>Set-PSReadlineOption -HistorySaveStyle ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: SaveNothing</code>.(Citation: Microsoft PowerShell Command History)(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SaveNothing</code>.(Citation: Microsoft PowerShell Command History)(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics) ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to disable historical command logging (e.g. no logging).

Output: T1562.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to disable historical command logging (e.g. no logging). ### Response: T1562.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.

Output: T1562.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. ### Response: T1562.004.


Instruction: List the MITRE techniques contained in the text.

Input: Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules.

Output: T1562.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. ### Response: T1562.004.


Instruction: List the MITRE techniques contained in the text.

Input: This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.

Output: T1562.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel. ### Response: T1562.004.


Instruction: List the MITRE techniques contained in the text.

Input: Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.

Output: T1562.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. ### Response: T1562.004.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may add a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port (i.e. [Non-Standard Port](https://attack.mitre.org/techniques/T1571)).(Citation: change_rdp_port_conti)

Output: T1562.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may add a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port (i.e. [Non-Standard Port](https://attack.mitre.org/techniques/T1571)).(Citation: change_rdp_port_conti) ### Response: T1562.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits.

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events)

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: This data is used by security tools and analysts to generate detections.

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This data is used by security tools and analysts to generate detections. ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: The EventLog service maintains event logs from various system components and applications.(Citation: EventLog_Core_Technologies)

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The EventLog service maintains event logs from various system components and applications.(Citation: EventLog_Core_Technologies) ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: By default, the service automatically starts when a system powers on.

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, the service automatically starts when a system powers on. ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs.

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.(Citation: Audit_Policy_Microsoft)(Citation: Advanced_sec_audit_policy_settings) auditpol.exe may also be used to set audit policies.(Citation: auditpol)

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.(Citation: Audit_Policy_Microsoft)(Citation: Advanced_sec_audit_policy_settings) auditpol.exe may also be used to set audit policies.(Citation: auditpol) ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target system-wide logging or just that of a particular application.

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target system-wide logging or just that of a particular application. ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the Windows EventLog service may be disabled using the Set-Service -Name EventLog -Status Stopped or sc config eventlog start=disabled commands (followed by manually stopping the service using Stop-Service  -Name EventLog).(Citation: Disable_Win_Event_Logging)(Citation: disable_win_evt_logging)

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the Windows EventLog service may be disabled using the Set-Service -Name EventLog -Status Stopped or sc config eventlog start=disabled commands (followed by manually stopping the service using Stop-Service  -Name EventLog).(Citation: Disable_Win_Event_Logging)(Citation: disable_win_evt_logging) ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, the service may be disabled by modifying the “Start” value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog then restarting the system for the change to take effect.(Citation: disable_win_evt_logging)

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, the service may be disabled by modifying the “Start” value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog then restarting the system for the change to take effect.(Citation: disable_win_evt_logging) ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: There are several ways to disable the EventLog service via registry key modification.

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are several ways to disable the EventLog service via registry key modification. ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: First, without Administrator privileges, adversaries may modify the "Start" value in the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security, then reboot the system to disable the Security EventLog.(Citation: winser19_file_overwrite_bug_twitter)

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: First, without Administrator privileges, adversaries may modify the "Start" value in the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security, then reboot the system to disable the Security EventLog.(Citation: winser19_file_overwrite_bug_twitter) ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: Second, with Administrator privilege, adversaries may modify the same values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application to disable the entire EventLog.(Citation: disable_win_evt_logging)

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Second, with Administrator privilege, adversaries may modify the same values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application to disable the entire EventLog.(Citation: disable_win_evt_logging) ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy.

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters.

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: For example, <code>auditpol /set

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, <code>auditpol /set ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: /category:”Account Logon”

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: /category:”Account Logon” ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: /success:

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: /success: ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: disable /failure:

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: disable /failure: ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: disable</code> turns off auditing for the Account Logon category.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco)

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: disable</code> turns off auditing for the Account Logon category.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: /allusers</code>.(Citation: T1562.002_redcanaryco)

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: /allusers</code>.(Citation: T1562.002_redcanaryco) ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.

Output: T1562.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind. ### Response: T1562.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware) ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also tamper with artifacts deployed and utilized by security tools.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also tamper with artifacts deployed and utilized by security tools. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: Security tools may make dynamic changes to system components in order to maintain visibility into specific events.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Security tools may make dynamic changes to system components in order to maintain visibility into specific events. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls)

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also focus on specific applications such as Sysmon.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also focus on specific applications such as Sysmon. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the “Start” and “Enable” values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging)

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the “Start” and “Enable” values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging) ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: On network devices, adversaries may attempt to skip digital signature verification checks by altering startup configuration files and effectively disabling firmware verification that typically occurs at boot.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)(Citation: Analysis of FG-IR-22-369)

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On network devices, adversaries may attempt to skip digital signature verification checks by altering startup configuration files and effectively disabling firmware verification that typically occurs at boot.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)(Citation: Analysis of FG-IR-22-369) ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor.

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor. ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)

Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)

Output: T1562.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)

Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware) ### Response: T1562.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: This could include maliciously redirecting(Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW)(Citation: Microsoft About Event Tracing 2018), by tampering settings that control the collection and flow of event telemetry.(Citation:

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This could include maliciously redirecting(Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW)(Citation: Microsoft About Event Tracing 2018), by tampering settings that control the collection and flow of event telemetry.(Citation: ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: Medium Event Tracing Tampering 2018)

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Medium Event Tracing Tampering 2018) ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1059/001) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1059/001) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may modify the `File` value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security to hide their malicious actions in a new or different .evtx log file.

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may modify the `File` value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security to hide their malicious actions in a new or different .evtx log file. ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input:
This action does not require a system reboot and takes effect immediately.(Citation: disable_win_evt_logging)

ETW interruption can be achieved multiple ways, however most directly by defining conditions using the [PowerShell](https://attack.mitre.org/techniques/T1059/001) Set-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations.

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This action does not require a system reboot and takes effect immediately.(Citation: disable_win_evt_logging)

ETW interruption can be achieved multiple ways, however most directly by defining conditions using the [PowerShell](https://attack.mitre.org/techniques/T1059/001) Set-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations. ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis.

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis. ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products.

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products. ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: In Linux environments, adversaries may disable or reconfigure log processing tools such as syslog or nxlog to inhibit detection and monitoring capabilities to facilitate follow on behaviors (Citation: LemonDuck).

Output: T1562.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Linux environments, adversaries may disable or reconfigure log processing tools such as syslog or nxlog to inhibit detection and monitoring capabilities to facilitate follow on behaviors (Citation: LemonDuck). ### Response: T1562.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detection.

Output: T1562.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detection. ### Response: T1562.012.


Instruction: List the MITRE techniques contained in the text.

Input: Linux admins use the Linux Audit system to track security-relevant information on a system.

Output: T1562.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Linux admins use the Linux Audit system to track security-relevant information on a system. ### Response: T1562.012.


Instruction: List the MITRE techniques contained in the text.

Input: The Linux Audit system operates at the kernel-level and maintains event logs on application and system activity such as process, network, file, and login events based on pre-configured rules.

Output: T1562.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Linux Audit system operates at the kernel-level and maintains event logs on application and system activity such as process, network, file, and login events based on pre-configured rules. ### Response: T1562.012.


Instruction: List the MITRE techniques contained in the text.

Input: Often referred to as `auditd`, this is the name of the daemon used to write events to disk and is governed by the parameters set in the `audit.conf` configuration file.

Output: T1562.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Often referred to as `auditd`, this is the name of the daemon used to write events to disk and is governed by the parameters set in the `audit.conf` configuration file. ### Response: T1562.012.


Instruction: List the MITRE techniques contained in the text.

Input: Two primary ways to configure the log generation rules are through the command line `auditctl` utility and the file `/etc/audit/audit.rules`,  containing a sequence of `auditctl` commands loaded at boot time.(Citation: Red Hat System Auditing)(Citation: IzyKnows auditd threat detection 2022)

Output: T1562.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Two primary ways to configure the log generation rules are through the command line `auditctl` utility and the file `/etc/audit/audit.rules`,  containing a sequence of `auditctl` commands loaded at boot time.(Citation: Red Hat System Auditing)(Citation: IzyKnows auditd threat detection 2022) ### Response: T1562.012.


Instruction: List the MITRE techniques contained in the text.

Input: With root privileges, adversaries may be able to ensure their activity is not logged through disabling the Audit system service, editing the configuration/rule files, or by hooking the Audit system library functions.

Output: T1562.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With root privileges, adversaries may be able to ensure their activity is not logged through disabling the Audit system service, editing the configuration/rule files, or by hooking the Audit system library functions. ### Response: T1562.012.


Instruction: List the MITRE techniques contained in the text.

Input: Using the command line, adversaries can disable the Audit system service through killing processes associated with `auditd` daemon or use `systemctl` to stop the Audit service.

Output: T1562.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using the command line, adversaries can disable the Audit system service through killing processes associated with `auditd` daemon or use `systemctl` to stop the Audit service. ### Response: T1562.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can also hook Audit system functions to disable logging or modify the rules contained in the `/etc/audit/audit.rules` or `audit.conf` files to ignore malicious activity.(Citation: Trustwave Honeypot SkidMap 2023)(Citation:

Output: T1562.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can also hook Audit system functions to disable logging or modify the rules contained in the `/etc/audit/audit.rules` or `audit.conf` files to ignore malicious activity.(Citation: Trustwave Honeypot SkidMap 2023)(Citation: ### Response: T1562.012.


Instruction: List the MITRE techniques contained in the text.

Input: ESET Ebury Feb 2014)

Output: T1562.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ESET Ebury Feb 2014) ### Response: T1562.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders’ awareness of malicious activity.(Citation:

Output: T1562.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders’ awareness of malicious activity.(Citation: ### Response: T1562.011.


Instruction: List the MITRE techniques contained in the text.

Input: BlackBasta) Messages produced by defensive tools contain information about potential security events as well as the functioning status of security software and the system.

Output: T1562.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: BlackBasta) Messages produced by defensive tools contain information about potential security events as well as the functioning status of security software and the system. ### Response: T1562.011.


Instruction: List the MITRE techniques contained in the text.

Input: Security reporting messages are important for monitoring the normal operation of a system and identifying important events that can signal a security incident.

Output: T1562.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Security reporting messages are important for monitoring the normal operation of a system and identifying important events that can signal a security incident. ### Response: T1562.011.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than or in addition to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), an adversary can spoof positive affirmations that security tools are continuing to function even after legitimate security tools have been disabled (e.g., [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001)).

Output: T1562.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than or in addition to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), an adversary can spoof positive affirmations that security tools are continuing to function even after legitimate security tools have been disabled (e.g., [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001)). ### Response: T1562.011.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can also present a “healthy” system status even after infection.

Output: T1562.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can also present a “healthy” system status even after infection. ### Response: T1562.011.


Instruction: List the MITRE techniques contained in the text.

Input: This can be abused to enable further malicious activity by delaying defender responses.

Output: T1562.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be abused to enable further malicious activity by delaying defender responses. ### Response: T1562.011.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may show a fake Windows Security GUI and tray icon with a “healthy” system status after Windows Defender and other system tools have been disabled.(Citation: BlackBasta)

Output: T1562.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may show a fake Windows Security GUI and tray icon with a “healthy” system status after Windows Defender and other system tools have been disabled.(Citation: BlackBasta) ### Response: T1562.011.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection.

Output: T1562.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. ### Response: T1562.008.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment.

Output: T1562.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. ### Response: T1562.008.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.

Output: T1562.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities. ### Response: T1562.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.(Citation: Following the CloudTrail:

Output: T1562.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.(Citation: Following the CloudTrail: ### Response: T1562.008.


Instruction: List the MITRE techniques contained in the text.

Input: Generating strong AWS security signals with Sumo Logic)

Output: T1562.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Generating strong AWS security signals with Sumo Logic) ### Response: T1562.008.


Instruction: List the MITRE techniques contained in the text.

Input: They may alternatively tamper with logging functionality – for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.(Citation: AWS Update Trail)(Citation: Pacu Detection Disruption Module)

Output: T1562.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may alternatively tamper with logging functionality – for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.(Citation: AWS Update Trail)(Citation: Pacu Detection Disruption Module) ### Response: T1562.008.


Instruction: List the MITRE techniques contained in the text.

Input: In Office 365, an adversary may disable logging on mail collection activities for specific users by using the `Set-MailboxAuditBypassAssociation` cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation:

Output: T1562.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Office 365, an adversary may disable logging on mail collection activities for specific users by using the `Set-MailboxAuditBypassAssociation` cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: ### Response: T1562.008.


Instruction: List the MITRE techniques contained in the text.

Input: Dark Reading Microsoft 365 Attacks 2021)

Output: T1562.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Dark Reading Microsoft 365 Attacks 2021) ### Response: T1562.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls.

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation. ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may downgrade and use various less-secure versions of features of a system, such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) or

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may downgrade and use various less-secure versions of features of a system, such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) or ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: [Network Sniffing](https://attack.mitre.org/techniques/T1040).(Citation:

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Network Sniffing](https://attack.mitre.org/techniques/T1040).(Citation: ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Praetorian TLS Downgrade Attack 2014)

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Praetorian TLS Downgrade Attack 2014) ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL) which can record executed script content.

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL) which can record executed script content. ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to [Impair Defenses](https://attack.mitre.org/techniques/T1562) while running malicious scripts that may have otherwise been detected.(Citation:

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to [Impair Defenses](https://attack.mitre.org/techniques/T1562) while running malicious scripts that may have otherwise been detected.(Citation: ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: CrowdStrike BGH Ransomware 2021)(Citation:

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CrowdStrike BGH Ransomware 2021)(Citation: ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant BYOL 2018)(Citation: att_def_ps_logging)

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant BYOL 2018)(Citation: att_def_ps_logging) ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.(Citation: Targeted SSL Stripping Attacks Are Real)(Citation: Crowdstrike Downgrade)

Output: T1562.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.(Citation: Targeted SSL Stripping Attacks Are Real)(Citation: Crowdstrike Downgrade) ### Response: T1562.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.

Output: T1562.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. ### Response: T1562.007.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004).

Output: T1562.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004). ### Response: T1562.007.