Instruction: List the MITRE techniques contained in the text.

Input: While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs:

Output: T1222.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: ### Response: T1222.002.


Instruction: List the MITRE techniques contained in the text.

Input: chown (short for change owner), and chmod (short for change mode).

Output: T1222.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: chown (short for change owner), and chmod (short for change mode). ### Response: T1222.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it.

Output: T1222.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it. ### Response: T1222.002.


Instruction: List the MITRE techniques contained in the text.

Input: They could subsequently lock others out of the file.

Output: T1222.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They could subsequently lock others out of the file. ### Response: T1222.002.


Instruction: List the MITRE techniques contained in the text.

Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004) or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).(Citation: 20 macOS Common Tools and Techniques)

Output: T1222.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004) or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).(Citation: 20 macOS Common Tools and Techniques) ### Response: T1222.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018)

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.). ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018)

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: If a matching entry is found, access to the object is granted.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If a matching entry is found, access to the object is granted. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018)

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018) ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs.

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).

Output: T1222.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574). ### Response: T1222.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018)

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions.

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.). ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions.

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: This may enable malicious activity such as modifying, replacing, or deleting specific files or directories.

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008),

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574). ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also change permissions of symbolic links.

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also change permissions of symbolic links. ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: For example, malware (particularly ransomware) may modify symbolic links and associated settings to enable access to files from local shortcuts with remote paths.(Citation: new_rust_based_ransomware)(Citation: bad_luck_blackcat)(Citation: falconoverwatch_blackcat_attack)(Citation: blackmatter_blackcat)(Citation: fsutil_behavior)

Output: T1222

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, malware (particularly ransomware) may modify symbolic links and associated settings to enable access to files from local shortcuts with remote paths.(Citation: new_rust_based_ransomware)(Citation: bad_luck_blackcat)(Citation: falconoverwatch_blackcat_attack)(Citation: blackmatter_blackcat)(Citation: fsutil_behavior) ### Response: T1222.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Additional custom tools likely exist as well.

Output: T1003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additional custom tools likely exist as well. ### Response: T1003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550). ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input:
For example, on the target host use procdump:

* procdump -ma lsass.exe lsass_dump

Locally, mimikatz can be run using:

* sekurlsa::Minidump lsassdump.dmp
* sekurlsa::logonPasswords

Built-in Windows tools such as comsvcs.dll can also be used:

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, on the target host use procdump:

* procdump -ma lsass.exe lsass_dump

Locally, mimikatz can be run using:

* sekurlsa::Minidump lsassdump.dmp
* sekurlsa::logonPasswords

Built-in Windows tools such as comsvcs.dll can also be used: ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: * rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID  lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation:

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID  lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Symantec Attacks Against Government Sector)

Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Symantec Attacks Against Government Sector)

Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014) ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input:
The following SSPs can be used to access credentials:

*

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The following SSPs can be used to access credentials:

* ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation:

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet Blogs Credential Protection)

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet Blogs Credential Protection) ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: * Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later. ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: * CredSSP:  Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation:

Output: T1003.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * CredSSP:  Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: ### Response: T1003.001.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet Blogs Credential Protection)

Output: T1003.001


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial, recurring, or future execution of malicious code.

Output: T1053.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial, recurring, or future execution of malicious code. ### Response: T1053.001.


Instruction: List the MITRE techniques contained in the text.

Input: The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)

Output: T1053.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux) ### Response: T1053.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use [at](https://attack.mitre.org/software/S0110) in Linux environments to execute programs at system startup or on a scheduled basis for persistence.

Output: T1053.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use [at](https://attack.mitre.org/software/S0110) in Linux environments to execute programs at system startup or on a scheduled basis for persistence. ### Response: T1053.001.


Instruction: List the MITRE techniques contained in the text.

Input: [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.

Output: T1053.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account. ### Response: T1053.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also abuse [at](https://attack.mitre.org/software/S0110) to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands.

Output: T1053.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also abuse [at](https://attack.mitre.org/software/S0110) to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands. ### Response: T1053.001.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, [at](https://attack.mitre.org/software/S0110) may also be used for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) if the binary is allowed to run as superuser via sudo.(Citation: GTFObins at)

Output: T1053.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, [at](https://attack.mitre.org/software/S0110) may also be used for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) if the binary is allowed to run as superuser via sudo.(Citation: GTFObins at) ### Response: T1053.001.


Instruction: List the MITRE techniques contained in the text.

Input: Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources.

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input: Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions.

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions. ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input: Hooking involves redirecting calls to these functions and can be implemented via:

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hooking involves redirecting calls to these functions and can be implemented via: ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs. ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft Hook Overview) (Citation: Elastic Process Injection July 2017)
*

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Hook Overview) (Citation: Elastic Process Injection July 2017)
* ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input: **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored. ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Elastic Process Injection July 2017) (Citation: Adlice Software IAT Hooks Oct 2014) (Citation: MWRInfoSecurity Dynamic Hooking 2015)
*

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017) (Citation: Adlice Software IAT Hooks Oct 2014) (Citation: MWRInfoSecurity Dynamic Hooking 2015)
* ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input: **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow. ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Elastic Process Injection July 2017) (Citation: HighTech Bridge Inline Hooking Sept 2011) (Citation: MWRInfoSecurity Dynamic Hooking 2015)

Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), adversaries may use hooking to load and execute malicious code within the context of another process, masking the execution while also allowing access to the process's memory and possibly elevated privileges.

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017) (Citation: HighTech Bridge Inline Hooking Sept 2011) (Citation: MWRInfoSecurity Dynamic Hooking 2015)

Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), adversaries may use hooking to load and execute malicious code within the context of another process, masking the execution while also allowing access to the process's memory and possibly elevated privileges. ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input: Installing hooking mechanisms may also provide Persistence via continuous invocation when the functions are called through normal use.

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Installing hooking mechanisms may also provide Persistence via continuous invocation when the functions are called through normal use. ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious hooking mechanisms may also capture API calls that include parameters that reveal user authentication credentials for Credential Access.

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious hooking mechanisms may also capture API calls that include parameters that reveal user authentication credentials for Credential Access. ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017)

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input: Hooking is commonly utilized by [Rootkit](https://attack.mitre.org/techniques/T1014)s to conceal files, processes, Registry keys, and other objects in order to hide malware and associated behaviors.

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hooking is commonly utilized by [Rootkit](https://attack.mitre.org/techniques/T1014)s to conceal files, processes, Registry keys, and other objects in order to hide malware and associated behaviors. ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Symantec Windows Rootkits)

Output: T1179

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Symantec Windows Rootkits) ### Response: T1179.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques.

Output: T1595.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. ### Response: T1595.003.


Instruction: List the MITRE techniques contained in the text.

Input: While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials.

Output: T1595.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. ### Response: T1595.003.


Instruction: List the MITRE techniques contained in the text.

Input: Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software.

Output: T1595.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. ### Response: T1595.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).

Output: T1595.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). ### Response: T1595.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation:

Output: T1595.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation: ### Response: T1595.003.


Instruction: List the MITRE techniques contained in the text.

Input: ClearSky Lebanese Cedar Jan 2021)

Output: T1595.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ClearSky Lebanese Cedar Jan 2021) ### Response: T1595.003.


Instruction: List the MITRE techniques contained in the text.

Input: This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)).

Output: T1595.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)). ### Response: T1595.003.


Instruction: List the MITRE techniques contained in the text.

Input: As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation:

Output: T1595.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation: ### Response: T1595.003.


Instruction: List the MITRE techniques contained in the text.

Output: T1595.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: S3Recon ### Response: T1595.003.


Instruction: List the MITRE techniques contained in the text.

Input: GitHub)(Citation: GCPBucketBrute)

Output: T1595.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub)(Citation: GCPBucketBrute) ### Response: T1595.003.


Instruction: List the MITRE techniques contained in the text.

Input: Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.

Output: T1595.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally. ### Response: T1595.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may scan victim IP blocks to gather information that can be used during targeting.

Output: T1595.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may scan victim IP blocks to gather information that can be used during targeting. ### Response: T1595.001.


Instruction: List the MITRE techniques contained in the text.

Input: Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.

Output: T1595.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. ### Response: T1595.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may scan IP blocks in order to [Gather Victim Network Information](https://attack.mitre.org/techniques/T1590), such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses.

Output: T1595.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may scan IP blocks in order to [Gather Victim Network Information](https://attack.mitre.org/techniques/T1590), such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses. ### Response: T1595.001.


Instruction: List the MITRE techniques contained in the text.

Input: Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts.(Citation: Botnet Scan) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1595.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts.(Citation: Botnet Scan) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1595.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).

Output: T1595.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)). ### Response: T1595.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may scan victims for vulnerabilities that can be used during targeting.

Output: T1595.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may scan victims for vulnerabilities that can be used during targeting. ### Response: T1595.002.


Instruction: List the MITRE techniques contained in the text.

Input: Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.

Output: T1595.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use. ### Response: T1595.002.


Instruction: List the MITRE techniques contained in the text.

Input: These scans may also include more broad attempts to [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592) that can be used to identify more commonly known, exploitable vulnerabilities.

Output: T1595.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These scans may also include more broad attempts to [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592) that can be used to identify more commonly known, exploitable vulnerabilities. ### Response: T1595.002.


Instruction: List the MITRE techniques contained in the text.

Input: Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.(Citation: OWASP Vuln Scanning) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1595.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.(Citation: OWASP Vuln Scanning) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1595.002.


Instruction: List the MITRE techniques contained in the text.

Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).

Output: T1595.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)). ### Response: T1595.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute active reconnaissance scans to gather information that can be used during targeting.

Output: T1595

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. ### Response: T1595.


Instruction: List the MITRE techniques contained in the text.

Input: Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Output: T1595

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. ### Response: T1595.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may perform different forms of active scanning depending on what information they seek to gather.

Output: T1595

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may perform different forms of active scanning depending on what information they seek to gather. ### Response: T1595.


Instruction: List the MITRE techniques contained in the text.

Input: These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).

Output: T1595

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)). ### Response: T1595.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can modify property list files (plist files) to execute their code as part of establishing persistence.

Output: T1547.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can modify property list files (plist files) to execute their code as part of establishing persistence. ### Response: T1547.011.


Instruction: List the MITRE techniques contained in the text.

Input: Plist files are used by macOS applications to store properties and configuration settings for applications and services.

Output: T1547.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Plist files are used by macOS applications to store properties and configuration settings for applications and services. ### Response: T1547.011.


Instruction: List the MITRE techniques contained in the text.

Input: Applications use information plist files, Info.plist, to tell the operating system how to handle the application at runtime using structured metadata in the form of keys and values.

Output: T1547.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Applications use information plist files, Info.plist, to tell the operating system how to handle the application at runtime using structured metadata in the form of keys and values. ### Response: T1547.011.


Instruction: List the MITRE techniques contained in the text.

Input: Plist files are formatted in XML and based on Apple's Core Foundation DTD and can be saved in text or binary format.(Citation: fileinfo plist file description)

Output: T1547.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Plist files are formatted in XML and based on Apple's Core Foundation DTD and can be saved in text or binary format.(Citation: fileinfo plist file description) ### Response: T1547.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can modify paths to executed binaries, add command line arguments, and insert key/pair values to plist files in auto-run locations which execute upon user logon or system startup.

Output: T1547.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can modify paths to executed binaries, add command line arguments, and insert key/pair values to plist files in auto-run locations which execute upon user logon or system startup. ### Response: T1547.011.


Instruction: List the MITRE techniques contained in the text.

Input: Through modifying plist files in these locations, adversaries can also execute a malicious dynamic library (dylib) by adding a dictionary containing the DYLD_INSERT_LIBRARIES key combined with a path to a malicious dylib under the EnvironmentVariables key in a plist file.

Output: T1547.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Through modifying plist files in these locations, adversaries can also execute a malicious dynamic library (dylib) by adding a dictionary containing the DYLD_INSERT_LIBRARIES key combined with a path to a malicious dylib under the EnvironmentVariables key in a plist file. ### Response: T1547.011.


Instruction: List the MITRE techniques contained in the text.

Input: Upon user logon, the plist is called for execution and the malicious dylib is executed within the process space.

Output: T1547.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Upon user logon, the plist is called for execution and the malicious dylib is executed within the process space. ### Response: T1547.011.


Instruction: List the MITRE techniques contained in the text.

Input: Persistence can also be achieved by modifying the LSEnvironment key in the application's Info.plist file.(Citation: wardle artofmalware volume1)

Output: T1547.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Persistence can also be achieved by modifying the LSEnvironment key in the application's Info.plist file.(Citation: wardle artofmalware volume1) ### Response: T1547.011.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context.

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page)

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page) ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: Normally an application is run in the current user’s context, regardless of which user or group owns the application.

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Normally an application is run in the current user’s context, regardless of which user or group owns the application. ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges. ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications (i.e. [Linux and Mac File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222/002)).

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications (i.e. [Linux and Mac File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222/002)). ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: The chmod command can set these bits with bitmasking, chmod 4777

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The chmod command can set these bits with bitmasking, chmod 4777 ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: [file] or via shorthand naming, chmod u+s

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [file] or via shorthand naming, chmod u+s ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: [file]</code>.

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [file]</code>. ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: This will enable the setuid bit.

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This will enable the setuid bit. ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: To enable the setgid bit, chmod 2775 and chmod g+s can be used.

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To enable the setgid bit, chmod 2775 and chmod g+s can be used. ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation:

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation: ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: OSX Keydnap malware)

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: OSX Keydnap malware) ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: This abuse is often part of a "shell escape" or other actions to bypass an execution environment with restricted permissions.

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This abuse is often part of a "shell escape" or other actions to bypass an execution environment with restricted permissions. ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: Alternatively, adversaries may choose to find and target vulnerable binaries with the setuid or setgid bits already enabled (i.e. [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)).

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternatively, adversaries may choose to find and target vulnerable binaries with the setuid or setgid bits already enabled (i.e. [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)). ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: The setuid and setguid bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l.

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The setuid and setguid bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l. ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: The find command can also be used to search for such files.

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The find command can also be used to search for such files. ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, find / -perm +4000 2>/dev/null can be used to find files with setuid set and find / -perm +2000 2>/dev/null may be used for setgid.

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, find / -perm +4000 2>/dev/null can be used to find files with setuid set and find / -perm +2000 2>/dev/null may be used for setgid. ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries that have these bits set may then be abused by adversaries.(Citation: GTFOBins Suid)

Output: T1548.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries that have these bits set may then be abused by adversaries.(Citation: GTFOBins Suid) ### Response: T1548.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: Just-in-time access is a mechanism for granting additional roles to cloud accounts in a granular, temporary manner.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Just-in-time access is a mechanism for granting additional roles to cloud accounts in a granular, temporary manner. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: This allows accounts to operate with only the permissions they need on a daily basis, and to request additional permissions as necessary.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This allows accounts to operate with only the permissions they need on a daily basis, and to request additional permissions as necessary. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: Sometimes just-in-time access requests are configured to require manual approval, while other times the desired permissions are automatically granted.(Citation:

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sometimes just-in-time access requests are configured to require manual approval, while other times the desired permissions are automatically granted.(Citation: ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input:
Google Cloud Just in Time Access 2023)(Citation: Azure Just in Time Access 2023)

Account impersonation allows user or service accounts to temporarily act with the permissions of another account.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Google Cloud Just in Time Access 2023)(Citation: Azure Just in Time Access 2023)

Account impersonation allows user or service accounts to temporarily act with the permissions of another account. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: For example, in GCP users with the `iam.serviceAccountTokenCreator` role can create temporary access tokens or sign arbitrary payloads with the permissions of a service account.(Citation: Google Cloud Service Account Authentication Roles)

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, in GCP users with the `iam.serviceAccountTokenCreator` role can create temporary access tokens or sign arbitrary payloads with the permissions of a service account.(Citation: Google Cloud Service Account Authentication Roles) ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: In Exchange Online, the `ApplicationImpersonation` role allows a service account to use the permissions associated with specified user accounts.(Citation:

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Exchange Online, the `ApplicationImpersonation` role allows a service account to use the permissions associated with specified user accounts.(Citation: ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input:
Microsoft Impersonation and EWS in Exchange)

Many cloud environments also include mechanisms for users to pass roles to resources that allow them to perform tasks and authenticate to other services.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Impersonation and EWS in Exchange)

Many cloud environments also include mechanisms for users to pass roles to resources that allow them to perform tasks and authenticate to other services. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: While the user that creates the resource does not directly assume the role they pass to it, they may still be able to take advantage of the role's access -- for example, by configuring the resource to perform certain actions with the permissions it has been granted.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While the user that creates the resource does not directly assume the role they pass to it, they may still be able to take advantage of the role's access -- for example, by configuring the resource to perform certain actions with the permissions it has been granted. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input:
In AWS, users with the `PassRole` permission can allow a service they create to assume a given role, while in GCP, users with the `iam.serviceAccountUser` role can attach a service account to a resource.(Citation: AWS PassRole)(Citation: Google Cloud Service Account Authentication Roles)

While users require specific role assignments in order to use any of these features, cloud administrators may misconfigure permissions.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In AWS, users with the `PassRole` permission can allow a service they create to assume a given role, while in GCP, users with the `iam.serviceAccountUser` role can attach a service account to a resource.(Citation: AWS PassRole)(Citation: Google Cloud Service Account Authentication Roles)

While users require specific role assignments in order to use any of these features, cloud administrators may misconfigure permissions. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input:
This could result in escalation paths that allow adversaries to gain access to resources beyond what was originally intended.(Citation: Rhino Google Cloud Privilege Escalation)(Citation: Rhino Security Labs AWS Privilege Escalation)

**Note:** this technique is distinct from [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003), which involves assigning permanent roles to accounts rather than abusing existing permissions structures to gain temporarily elevated access to resources.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This could result in escalation paths that allow adversaries to gain access to resources beyond what was originally intended.(Citation: Rhino Google Cloud Privilege Escalation)(Citation: Rhino Security Labs AWS Privilege Escalation)

**Note:** this technique is distinct from [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003), which involves assigning permanent roles to accounts rather than abusing existing permissions structures to gain temporarily elevated access to resources. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: However, adversaries that compromise a sufficiently privileged account may grant another account they control

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, adversaries that compromise a sufficiently privileged account may grant another account they control ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) that would allow them to also abuse these features.

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) that would allow them to also abuse these features. ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: This may also allow for greater stealth than would be had by directly using the highly privileged account, especially when logs do not clarify when role impersonation is taking place.(Citation: CrowdStrike StellarParticle January 2022)

Output: T1548.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also allow for greater stealth than would be had by directly using the highly privileged account, especially when logs do not clarify when role impersonation is taking place.(Citation: CrowdStrike StellarParticle January 2022) ### Response: T1548.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bypass UAC mechanisms to elevate process privileges on system.

Output: T1548.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bypass UAC mechanisms to elevate process privileges on system. ### Response: T1548.002.


Instruction: List the MITRE techniques contained in the text.

Input: Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.

Output: T1548.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. ### Response: T1548.002.


Instruction: List the MITRE techniques contained in the text.

Input: The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)

Output: T1548.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works) ### Response: T1548.002.


Instruction: List the MITRE techniques contained in the text.

Input: If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box.(Citation: TechNet Inside UAC)(Citation: MSDN COM Elevation)

Output: T1548.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box.(Citation: TechNet Inside UAC)(Citation: MSDN COM Elevation) ### Response: T1548.002.


Instruction: List the MITRE techniques contained in the text.

Input: An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access.

Output: T1548.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. ### Response: T1548.002.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)

Output: T1548.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows) ### Response: T1548.002.


Instruction: List the MITRE techniques contained in the text.

Input: Many methods have been discovered to bypass UAC.

Output: T1548.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many methods have been discovered to bypass UAC. ### Response: T1548.002.


Instruction: List the MITRE techniques contained in the text.

Input: The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses.

Output: T1548.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. ### Response: T1548.002.


Instruction: List the MITRE techniques contained in the text.

Input:
Additional bypass methods are regularly discovered and some used in the wild, such as:

* eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)

Output: T1548.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additional bypass methods are regularly discovered and some used in the wild, such as:

* eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit) ### Response: T1548.002.


Instruction: List the MITRE techniques contained in the text.

Input: Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass)

Output: T1548.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass) ### Response: T1548.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges)

Output: T1548.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) ### Response: T1548.004.