Instruction: List the MITRE techniques contained in the text.

Input: Similarly, the “+s” marks a file as a system file and the “+r” flag marks the file as read only.

Output: T1158

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, the “+s” marks a file as a system file and the “+r” flag marks the file as read only. ### Response: T1158.


Instruction: List the MITRE techniques contained in the text.

Input: Like most windows binaries, the attrib.exe binary provides the ability to apply these changes recursively “/S”.

Output: T1158

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Like most windows binaries, the attrib.exe binary provides the ability to apply these changes recursively “/S”. ### Response: T1158.


Instruction: List the MITRE techniques contained in the text.

Input:
### Linux/Mac

Users can mark specific files as hidden simply by putting a “.”

Output: T1158

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ### Linux/Mac

Users can mark specific files as hidden simply by putting a “.” ### Response: T1158.


Instruction: List the MITRE techniques contained in the text.

Input: as the first character in the file or folder name  (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware).

Output: T1158

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: as the first character in the file or folder name  (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). ### Response: T1158.


Instruction: List the MITRE techniques contained in the text.

Input: Files and folder that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”.

Output: T1158

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Files and folder that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. ### Response: T1158.


Instruction: List the MITRE techniques contained in the text.

Input: Users must specifically change settings to have these files viewable.

Output: T1158

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users must specifically change settings to have these files viewable. ### Response: T1158.


Instruction: List the MITRE techniques contained in the text.

Input: For command line usages, there is typically a flag to see all files (including hidden ones).

Output: T1158

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For command line usages, there is typically a flag to see all files (including hidden ones). ### Response: T1158.


Instruction: List the MITRE techniques contained in the text.

Input: To view these files in the Finder Application, the following command must be executed: defaults write com.apple.finder AppleShowAllFiles YES, and then relaunch the Finder Application.

Output: T1158

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To view these files in the Finder Application, the following command must be executed: defaults write com.apple.finder AppleShowAllFiles YES, and then relaunch the Finder Application. ### Response: T1158.


Instruction: List the MITRE techniques contained in the text.

Input:
### Mac

Files on macOS can be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker).

Output: T1158

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ### Mac

Files on macOS can be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). ### Response: T1158.


Instruction: List the MITRE techniques contained in the text.

Input: Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace.

Output: T1158

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. ### Response: T1158.


Instruction: List the MITRE techniques contained in the text.

Input: For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.

Output: T1158

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys. ### Response: T1158.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt).

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.(Citation: Microsoft Open XML July 2017)

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.(Citation: Microsoft Open XML July 2017) ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: Properties within parts may reference shared public resources accessed via online URLs.

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Properties within parts may reference shared public resources accessed via online URLs. ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: For example, template properties may reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, template properties may reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded. ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these templates to initially conceal malicious code to be executed via user documents.

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these templates to initially conceal malicious code to be executed via user documents. ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded.(Citation: SANS Brian Wiltse Template Injection)

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded.(Citation: SANS Brian Wiltse Template Injection) ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: These documents can be delivered via other techniques such as [Phishing](https://attack.mitre.org/techniques/T1566) and/or

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These documents can be delivered via other techniques such as [Phishing](https://attack.mitre.org/techniques/T1566) and/or ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: [Taint Shared Content](https://attack.mitre.org/techniques/T1080) and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched.(Citation:

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Taint Shared Content](https://attack.mitre.org/techniques/T1080) and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched.(Citation: ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: Redxorblue Remote Template Injection) Examples have been seen in the wild where template injection was used to load malicious code containing an exploit.(Citation: MalwareBytes Template Injection OCT 2017)

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Redxorblue Remote Template Injection) Examples have been seen in the wild where template injection was used to load malicious code containing an exploit.(Citation: MalwareBytes Template Injection OCT 2017) ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also modify the <code>*\template</code> control word within an .rtf file to similarly conceal then download malicious code.

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also modify the <code>*\template</code> control word within an .rtf file to similarly conceal then download malicious code. ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: This legitimate control word value is intended to be a file destination of a template file resource that is retrieved and loaded when an .rtf file is opened.

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This legitimate control word value is intended to be a file destination of a template file resource that is retrieved and loaded when an .rtf file is opened. ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: However, adversaries may alter the bytes of an existing .rtf file to insert a template control word field to include a URL resource of a malicious payload.(Citation:

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, adversaries may alter the bytes of an existing .rtf file to insert a template control word field to include a URL resource of a malicious payload.(Citation: ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: Proofpoint RTF Injection)(Citation:

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Proofpoint RTF Injection)(Citation: ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: Ciberseguridad Decoding malicious RTF files)

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Ciberseguridad Decoding malicious RTF files) ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: This technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.(Citation: Anomali Template Injection MAR 2018)(Citation: Talos Template Injection July 2017)(Citation: ryhanson phishery SEPT 2016)

Output: T1221

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.(Citation: Anomali Template Injection MAR 2018)(Citation: Talos Template Injection July 2017)(Citation: ryhanson phishery SEPT 2016) ### Response: T1221.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: These scripts can vary based on operating system and whether applied locally or remotely.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These scripts can vary based on operating system and whether applied locally or remotely. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use these scripts to maintain persistence on a single system.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use these scripts to maintain persistence on a single system. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

Output: T1037

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges. ### Response: T1037.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup.

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup. ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: These files allow system administrators to map and start custom services at startup for different run levels.

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These files allow system administrators to map and start custom services at startup for different run levels. ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: RC scripts require root privileges to modify.

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: RC scripts require root privileges to modify. ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation:

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: Intezer HiddenWasp Map 2019)

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Intezer HiddenWasp Map 2019) ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: Upon reboot, the system executes the script's contents as root, resulting in persistence.

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Upon reboot, the system executes the script's contents as root, resulting in persistence. ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as IoT or embedded systems.(Citation: intezer-kaiji-malware)

Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts.

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as IoT or embedded systems.(Citation: intezer-kaiji-malware)

Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: This is now a deprecated mechanism in macOS in favor of [Launchd](https://attack.mitre.org/techniques/T1053/004).

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is now a deprecated mechanism in macOS in favor of [Launchd](https://attack.mitre.org/techniques/T1053/004). ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items)

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)

Output: T1037.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc) ### Response: T1037.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, this may be useful for when the target user has a non-network logon session on the system.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, this may be useful for when the target user has a non-network logon session on the system. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.

Output: T1134.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one. ### Response: T1134.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.

Output: T1134.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. ### Response: T1134.004.


Instruction: List the MITRE techniques contained in the text.

Input: New processes are typically spawned directly from their parent, or calling, process unless explicitly specified.

Output: T1134.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. ### Response: T1134.004.


Instruction: List the MITRE techniques contained in the text.

Input: One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009)

Output: T1134.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) ### Response: T1134.004.


Instruction: List the MITRE techniques contained in the text.

Input: This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.(Citation:

Output: T1134.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.(Citation: ### Response: T1134.004.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft UAC Nov 2018)

Output: T1134.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft UAC Nov 2018) ### Response: T1134.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of [PowerShell](https://attack.mitre.org/techniques/T1059/001)/[Rundll32](https://attack.mitre.org/techniques/T1218/011) to be explorer.exe rather than an Office document delivered as part of [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001).(Citation: CounterCept PPID Spoofing Dec 2018)

Output: T1134.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of [PowerShell](https://attack.mitre.org/techniques/T1059/001)/[Rundll32](https://attack.mitre.org/techniques/T1218/011) to be explorer.exe rather than an Office document delivered as part of [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001).(Citation: CounterCept PPID Spoofing Dec 2018) ### Response: T1134.004.


Instruction: List the MITRE techniques contained in the text.

Input: This spoofing could be executed via [Visual Basic](https://attack.mitre.org/techniques/T1059/005) within a malicious Office document or any code that can perform [Native API](https://attack.mitre.org/techniques/T1106).(Citation: CTD PPID Spoofing Macro Mar 2019)(Citation:

Output: T1134.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This spoofing could be executed via [Visual Basic](https://attack.mitre.org/techniques/T1059/005) within a malicious Office document or any code that can perform [Native API](https://attack.mitre.org/techniques/T1106).(Citation: CTD PPID Spoofing Macro Mar 2019)(Citation: ### Response: T1134.004.


Instruction: List the MITRE techniques contained in the text.

Input:
CounterCept PPID Spoofing Dec 2018)

Explicitly assigning the PPID may also enable elevated privileges given appropriate access rights to the parent process.

Output: T1134.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CounterCept PPID Spoofing Dec 2018)

Explicitly assigning the PPID may also enable elevated privileges given appropriate access rights to the parent process. ### Response: T1134.004.


Instruction: List the MITRE techniques contained in the text.

Input: For example, an adversary in a privileged user context (i.e. administrator) may spawn a new process and assign the parent as a process running as SYSTEM (such as lsass.exe), causing the new process to be elevated via the inherited access token.(Citation: XPNSec PPID Nov 2017)

Output: T1134.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, an adversary in a privileged user context (i.e. administrator) may spawn a new process and assign the parent as a process running as SYSTEM (such as lsass.exe), causing the new process to be elevated via the inherited access token.(Citation: XPNSec PPID Nov 2017) ### Response: T1134.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use SID-History Injection to escalate privileges and bypass access controls.

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows security identifier (SID) is a unique value that identifies a user or group account.

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows security identifier (SID) is a unique value that identifies a user or group account. ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: SIDs are used by Windows security in both security descriptors and access tokens.

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SIDs are used by Windows security in both security descriptors and access tokens. ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft SID)

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft SID) ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens). ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators.

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).

Output: T1134.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006). ### Response: T1134.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls.

Output: T1134.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. ### Response: T1134.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.(Citation: Microsoft RunAs)

Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used.

Output: T1134.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.(Citation: Microsoft RunAs)

Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. ### Response: T1134.002.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the token could be duplicated via [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or created via [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) before being used to create a process.

Output: T1134.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the token could be duplicated via [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or created via [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) before being used to create a process. ### Response: T1134.002.


Instruction: List the MITRE techniques contained in the text.

Input: While this technique is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001), the techniques can be used in conjunction where a token is duplicated and then used to create a new process.

Output: T1134.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While this technique is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001), the techniques can be used in conjunction where a token is duplicated and then used to create a new process. ### Response: T1134.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls.

Output: T1134.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. ### Response: T1134.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.

Output: T1134.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. ### Response: T1134.003.


Instruction: List the MITRE techniques contained in the text.

Input: The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.

Output: T1134.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. ### Response: T1134.003.


Instruction: List the MITRE techniques contained in the text.

Input: This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.

Output: T1134.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one. ### Response: T1134.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: Windows uses access tokens to determine the ownership of a running process.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows uses access tokens to determine the ownership of a running process. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: When this occurs, the process also takes on the security context associated with the new token.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When this occurs, the process also takes on the security context associated with the new token. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)).

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary must already be in a privileged user context (i.e. administrator) to steal a token.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary must already be in a privileged user context (i.e. administrator) to steal a token. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input:
An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)

Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)

Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.

Output: T1134

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens. ### Response: T1134.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows Time service (W32Time) enables time synchronization across and within domains.

Output: T1209

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows Time service (W32Time) enables time synchronization across and within domains. ### Response: T1209.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft W32Time Feb 2018)

Output: T1209

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft W32Time Feb 2018) ### Response: T1209.


Instruction: List the MITRE techniques contained in the text.

Input: W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.

Output: T1209

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients. ### Response: T1209.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft TimeProvider)

Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\.

Output: T1209

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft TimeProvider)

Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\. ### Response: T1209.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft TimeProvider)

Output: T1209

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft TimeProvider) ### Response: T1209.


Instruction: List the MITRE techniques contained in the text.

Input: The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.

Output: T1209

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed. ### Response: T1209.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft TimeProvider)

Output: T1209


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse this architecture to establish Persistence, specifically by registering and enabling a malicious DLL as a time provider.

Output: T1209

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse this architecture to establish Persistence, specifically by registering and enabling a malicious DLL as a time provider. ### Response: T1209.


Instruction: List the MITRE techniques contained in the text.

Input: Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.

Output: T1209

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account. ### Response: T1209.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Github W32Time

Output: T1209

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Github W32Time ### Response: T1209.


Instruction: List the MITRE techniques contained in the text.

Input: Oct 2017)

Output: T1209

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Oct 2017) ### Response: T1209.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources.

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use.

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token.

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Mandiant M Trends 2011)

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Mandiant M Trends 2011) ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID.

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes).

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: GCN RSA June 2011)

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: GCN RSA June 2011) ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: Other methods of MFA may be intercepted and used by an adversary to authenticate.

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Other methods of MFA may be intercepted and used by an adversary to authenticate. ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: It is common for one-time codes to be sent via out-of-band communications (email, SMS).

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is common for one-time codes to be sent via out-of-band communications (email, SMS). ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: If the device and/or service is not secured, then it may be vulnerable to interception.

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the device and/or service is not secured, then it may be vulnerable to interception. ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: phones.(Citation: Okta Scatter Swine 2022)

Output: T1111

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: phones.(Citation: Okta Scatter Swine 2022) ### Response: T1111.


Instruction: List the MITRE techniques contained in the text.

Input: Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in /System/Library/LaunchAgents, /Library/LaunchAgents, and $HOME/Library/LaunchAgents (Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware).

Output: T1159

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in /System/Library/LaunchAgents, /Library/LaunchAgents, and $HOME/Library/LaunchAgents (Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware). ### Response: T1159.


Instruction: List the MITRE techniques contained in the text.

Input: These launch agents have property list files which point to the executables that will be launched (Citation: OSX.Dok Malware).

Output: T1159

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These launch agents have property list files which point to the executables that will be launched (Citation: OSX.Dok Malware). ### Response: T1159.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install a new launch agent that can be configured to execute at login by using launchd or launchctl to load a plist into the appropriate directories  (Citation: Sofacy Komplex Trojan)  (Citation: Methods of Mac Malware Persistence).

Output: T1159

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install a new launch agent that can be configured to execute at login by using launchd or launchctl to load a plist into the appropriate directories  (Citation: Sofacy Komplex Trojan)  (Citation: Methods of Mac Malware Persistence). ### Response: T1159.


Instruction: List the MITRE techniques contained in the text.

Input: The agent name may be disguised by using a name from a related operating system or benign software.

Output: T1159

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The agent name may be disguised by using a name from a related operating system or benign software. ### Response: T1159.


Instruction: List the MITRE techniques contained in the text.

Input: Launch Agents are created with user level privileges and are executed with the privileges of the user when they log in (Citation: OSX Malware Detection)

Output: T1159

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launch Agents are created with user level privileges and are executed with the privileges of the user when they log in (Citation: OSX Malware Detection) ### Response: T1159.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: OceanLotus for OS X).

Output: T1159

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: OceanLotus for OS X). ### Response: T1159.


Instruction: List the MITRE techniques contained in the text.

Input: They can be set up to execute when a specific user logs in (in the specific user’s directory structure) or when any user logs in (which requires administrator privileges).

Output: T1159

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They can be set up to execute when a specific user logs in (in the specific user’s directory structure) or when any user logs in (which requires administrator privileges). ### Response: T1159.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: This is common behavior that can be used across different platforms and the network to evade defenses.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is common behavior that can be used across different platforms and the network to evade defenses. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may be compressed, archived, or encrypted in order to avoid detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may be compressed, archived, or encrypted in order to avoid detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: These payloads may be used during Initial Access or later to mitigate detection.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These payloads may be used during Initial Access or later to mitigate detection. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Volexity PowerDuke November 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Volexity PowerDuke November 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use compressed or archived scripts, such as JavaScript.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use compressed or archived scripts, such as JavaScript. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Linux/Cdorked.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Linux/Cdorked. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: A We Live Security Analysis)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A We Live Security Analysis) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Carbon Black Obfuscation Sept 2016)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Carbon Black Obfuscation Sept 2016) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Obfuscation June 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Obfuscation June 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017)

Output: T1027

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ### Response: T1027.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may perform software packing or virtual machine software protection to conceal their code.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may perform software packing or virtual machine software protection to conceal their code. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Software packing is a method of compressing or encrypting an executable.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Software packing is a method of compressing or encrypting an executable. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Packing an executable changes the file signature in an attempt to avoid signature-based detection.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Packing an executable changes the file signature in an attempt to avoid signature-based detection. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Most decompression techniques decompress the executable code in memory.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most decompression techniques decompress the executable code in memory. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Utilities used to perform software packing are called packers.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilities used to perform software packing are called packers. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Example packers are MPRESS and UPX.

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Example packers are MPRESS and UPX. ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation:

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation: ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Awesome Executable Packing)

Output: T1027.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Awesome Executable Packing) ### Response: T1027.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise third-party infrastructure that can be used during targeting.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise third-party infrastructure that can be used during targeting. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation:

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation:

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Use of compromised infrastructure allows adversaries to stage, launch, and execute operations.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Phishing](https://attack.mitre.org/techniques/T1566) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: campaigns.(Citation: FireEye DNS Hijack 2019)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: campaigns.(Citation: FireEye DNS Hijack 2019) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting.

Output: T1584.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting. ### Response: T1584.007.


Instruction: List the MITRE techniques contained in the text.

Input: By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.

Output: T1584.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. ### Response: T1584.007.


Instruction: List the MITRE techniques contained in the text.

Input: Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector)

Output: T1584.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector) ### Response: T1584.007.