Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use LKMs and kexts to conduct [Persistence](https://attack.mitre.org/tactics/TA0003) and/or

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use LKMs and kexts to conduct [Persistence](https://attack.mitre.org/tactics/TA0003) and/or ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) on a system.

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) on a system. ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: Examples have been found in the wild, and there are some relevant open source projects as well.(Citation: Volatility Phalanx2)(Citation:

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples have been found in the wild, and there are some relevant open source projects as well.(Citation: Volatility Phalanx2)(Citation: ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: CrowdStrike Linux Rootkit)(Citation:

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CrowdStrike Linux Rootkit)(Citation: ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: GitHub Reptile)(Citation:

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub Reptile)(Citation: ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle)(Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir)(Citation: Trend Micro Skidmap)

Output: T1547.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle)(Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir)(Citation: Trend Micro Skidmap) ### Response: T1547.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use methods of capturing user input to obtain credentials or collect information.

Output: T1056

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use methods of capturing user input to obtain credentials or collect information. ### Response: T1056.


Instruction: List the MITRE techniques contained in the text.

Input: During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes.

Output: T1056

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. ### Response: T1056.


Instruction: List the MITRE techniques contained in the text.

Input: Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).

Output: T1056

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)). ### Response: T1056.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt.

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)). ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper)

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm Do You Trust Oct 2014)(Citation:

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: OSX Keydnap malware)(Citation: Spoofing credential dialogs)

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: OSX Keydnap malware)(Citation: Spoofing credential dialogs) ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: and [PowerShell](https://attack.mitre.org/techniques/T1059/001).(Citation: LogRhythm

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: and [PowerShell](https://attack.mitre.org/techniques/T1059/001).(Citation: LogRhythm ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: Do You Trust Oct 2014)(Citation:

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Do You Trust Oct 2014)(Citation: ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: Enigma Phishing for Credentials Jan 2015)(Citation:

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Enigma Phishing for Credentials Jan 2015)(Citation: ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: Spoofing credential dialogs)

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spoofing credential dialogs) ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. [Unix Shell](https://attack.mitre.org/techniques/T1059/004)).(Citation: Spoofing credential dialogs)

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. [Unix Shell](https://attack.mitre.org/techniques/T1059/004)).(Citation: Spoofing credential dialogs) ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password.

Output: T1097

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. ### Response: T1097.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos authentication can be used as the first step to lateral movement to a remote system.

Output: T1097

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos authentication can be used as the first step to lateral movement to a remote system. ### Response: T1097.


Instruction: List the MITRE techniques contained in the text.

Input: In this technique, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).

Output: T1097

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this technique, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). ### Response: T1097.


Instruction: List the MITRE techniques contained in the text.

Input: A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access.

Output: T1097

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. ### Response: T1097.


Instruction: List the MITRE techniques contained in the text.

Input: A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.

Output: T1097

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access. ### Response: T1097.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: ADSecurity AD Kerberos Attacks) (Citation: GentilKiwi Pass the Ticket)

Silver Tickets can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).

Output: T1097

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: ADSecurity AD Kerberos Attacks) (Citation: GentilKiwi Pass the Ticket)

Silver Tickets can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint). ### Response: T1097.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: ADSecurity AD Kerberos Attacks)

Golden Tickets can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.

Output: T1097

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: ADSecurity AD Kerberos Attacks)

Golden Tickets can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory. ### Response: T1097.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Campbell 2014)

Output: T1097

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Campbell 2014) ### Response: T1097.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy and/or steal capabilities that can be used during targeting.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy and/or steal capabilities that can be used during targeting. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities.

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab)

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries).

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)

Output: T1588

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise) ### Response: T1588.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy, steal, or download software tools that can be used during targeting.

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy, steal, or download software tools that can be used during targeting. ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: Tools can be open or closed source, free or commercial.

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Tools can be open or closed source, free or commercial. ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)).

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154).

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154). ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.(Citation: Recorded Future Beacon 2019)

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.(Citation: Recorded Future Beacon 2019) ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors.

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries).

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.

Output: T1052

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. ### Response: T1052.


Instruction: List the MITRE techniques contained in the text.

Input: In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user.

Output: T1052

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. ### Response: T1052.


Instruction: List the MITRE techniques contained in the text.

Input: Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device.

Output: T1052

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. ### Response: T1052.


Instruction: List the MITRE techniques contained in the text.

Input: The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Output: T1052

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems. ### Response: T1052.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to exfiltrate data over a USB connected physical device.

Output: T1052.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to exfiltrate data over a USB connected physical device. ### Response: T1052.001.


Instruction: List the MITRE techniques contained in the text.

Input: In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user.

Output: T1052.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. ### Response: T1052.001.


Instruction: List the MITRE techniques contained in the text.

Input: The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Output: T1052.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems. ### Response: T1052.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: How the operating system locates libraries to be used by a program can also be intercepted.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: How the operating system locates libraries to be used by a program can also be intercepted. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads.(Citation: Lazarus APT January 2022)(Citation:

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads.(Citation: Lazarus APT January 2022)(Citation: ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: FinFisher exposed )

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FinFisher exposed ) ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: The KernelCallbackTable can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once user32.dll is loaded.(Citation: Windows Process Injection KernelCallbackTable)

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The KernelCallbackTable can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once user32.dll is loaded.(Citation: Windows Process Injection KernelCallbackTable) ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may hijack the execution flow of a process using the KernelCallbackTable by replacing an original callback function with a malicious payload.

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may hijack the execution flow of a process using the KernelCallbackTable by replacing an original callback function with a malicious payload. ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: Modifying callback functions can be achieved in various ways involving related behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) or [Process Injection](https://attack.mitre.org/techniques/T1055) into another process.

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Modifying callback functions can be achieved in various ways involving related behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) or [Process Injection](https://attack.mitre.org/techniques/T1055) into another process. ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: A pointer to the memory address of the KernelCallbackTable can be obtained by locating the PEB (ex: via a call to the NtQueryInformationProcess()

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A pointer to the memory address of the KernelCallbackTable can be obtained by locating the PEB (ex: via a call to the NtQueryInformationProcess() ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: [Native API](https://attack.mitre.org/techniques/T1106) function).(Citation: NtQueryInformationProcess)

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Native API](https://attack.mitre.org/techniques/T1106) function).(Citation: NtQueryInformationProcess) ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: Once the pointer is located, the KernelCallbackTable can be duplicated, and a function in the table (e.g., fnCOPYDATA) set to the address of a malicious payload (ex: via WriteProcessMemory()).

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once the pointer is located, the KernelCallbackTable can be duplicated, and a function in the table (e.g., fnCOPYDATA) set to the address of a malicious payload (ex: via WriteProcessMemory()). ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: The PEB is then updated with the new address of the table.

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The PEB is then updated with the new address of the table. ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: Once the tampered function is invoked, the malicious payload will be triggered.(Citation:

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once the tampered function is invoked, the malicious payload will be triggered.(Citation: ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: Lazarus APT January 2022)

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Lazarus APT January 2022) ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: The tampered function is typically invoked using a Windows message.

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The tampered function is typically invoked using a Windows message. ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: After the process is hijacked and malicious code is executed, the KernelCallbackTable may also be restored to its original state by the rest of the malicious payload.(Citation:

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After the process is hijacked and malicious code is executed, the KernelCallbackTable may also be restored to its original state by the rest of the malicious payload.(Citation: ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: Lazarus APT January 2022)

Output: T1574.013


Instruction: List the MITRE techniques contained in the text.

Input: Use of the KernelCallbackTable to hijack execution flow may evade detection from security products since the execution can be masked under a legitimate process.

Output: T1574.013

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of the KernelCallbackTable to hijack execution flow may evade detection from security products since the execution can be masked under a legitimate process. ### Response: T1574.013.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting.

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported.

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds)

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search in private threat intelligence vendor data to gather actionable information.

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search in private threat intelligence vendor data to gather actionable information. ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Threat actors may seek information/indicators gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns.

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Threat actors may seek information/indicators gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).

Output: T1597.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)). ### Response: T1597.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may purchase technical information about victims that can be used during targeting.

Output: T1597.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may purchase technical information about victims that can be used during targeting. ### Response: T1597.002.


Instruction: List the MITRE techniques contained in the text.

Input: Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services.

Output: T1597.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. ### Response: T1597.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.

Output: T1597.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. ### Response: T1597.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches.

Output: T1597.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. ### Response: T1597.002.


Instruction: List the MITRE techniques contained in the text.

Input: Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1597.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1597.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search and gather information about victims from closed sources that can be used during targeting.

Output: T1597

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search and gather information about victims from closed sources that can be used during targeting. ### Response: T1597.


Instruction: List the MITRE techniques contained in the text.

Input: Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data.(Citation: D3Secutrity CTI Feeds)

Output: T1597

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data.(Citation: D3Secutrity CTI Feeds) ### Response: T1597.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation:

Output: T1597

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ### Response: T1597.


Instruction: List the MITRE techniques contained in the text.

Input:
ZDNET Selling Data)

Adversaries may search in different closed databases depending on what information they seek to gather.

Output: T1597

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ZDNET Selling Data)

Adversaries may search in different closed databases depending on what information they seek to gather. ### Response: T1597.


Instruction: List the MITRE techniques contained in the text.

Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Output: T1597

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). ### Response: T1597.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments).

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation:

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet Task Scheduler Security)

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet Task Scheduler Security) ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges).

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges). ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent)

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.(Citation: ProofPoint Serpent) ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Systemd timers are unit files with file extension <code>.timer</code> that control services.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Systemd timers are unit files with file extension <code>.timer</code> that control services. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Timers can be set to run on a calendar event or after a time span relative to a starting point.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Timers can be set to run on a calendar event or after a time span relative to a starting point. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020)

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020) ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input:
Systemd timers may be activated remotely via the systemctl command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control)

Each .timer file must have a corresponding .service file with the same name, e.g., example.timer and example.service.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Systemd timers may be activated remotely via the systemctl command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control)

Each .timer file must have a corresponding .service file with the same name, e.g., example.timer and example.service. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: <code>.service</code> files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation:

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: <code>.service</code> files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Linux man-pages: systemd January 2014)

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Linux man-pages: systemd January 2014) ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018)

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Timers installed using privileged paths may be used to maintain root level persistence.

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Timers installed using privileged paths may be used to maintain root level persistence. ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also install user level timers to achieve user level persistence.(Citation: Falcon Sandbox smp: 28553b3a9d)

Output: T1053.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also install user level timers to achieve user level persistence.(Citation: Falcon Sandbox smp: 28553b3a9d) ### Response: T1053.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing with a link is a specific variant of spearphishing.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing with a link is a specific variant of spearphishing. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing may also involve social engineering techniques, such as posing as a trusted source. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: In this case, the malicious emails contain links.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this case, the malicious emails contain links. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204).

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack").(Citation: CISA IDN ST05-016) URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023)

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack").(Citation: CISA IDN ST05-016) URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023) ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also utilize links to perform consent phishing, typically with OAuth 2.0 request URLs that when accepted by the user provide permissions/access for malicious applications, allowing adversaries to  [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation:

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also utilize links to perform consent phishing, typically with OAuth 2.0 request URLs that when accepted by the user provide permissions/access for malicious applications, allowing adversaries to  [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation: ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Trend Micro Pawn Storm OAuth 2017)

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Trend Micro Pawn Storm OAuth 2017) ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls.

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft OAuth 2.0

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft OAuth 2.0 ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Consent Phishing 2021)

Output: T1566.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Consent Phishing 2021) ### Response: T1566.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing attachment is a specific variant of spearphishing.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing attachment is a specific variant of spearphishing. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing may also involve social engineering techniques, such as posing as a trusted source. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.

Output: T1566.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one. ### Response: T1566.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use voice communications to ultimately gain access to victim systems.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use voice communications to ultimately gain access to victim systems. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing voice is a specific variant of spearphishing.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing voice is a specific variant of spearphishing. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: It is different from other forms of spearphishing in that is employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is different from other forms of spearphishing in that is employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: [Impersonation](https://attack.mitre.org/techniques/T1656))

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: and/or creating a sense of urgency or alarm for the recipient.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: and/or creating a sense of urgency or alarm for the recipient. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of phishing are electronically delivered social engineering.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of phishing are electronically delivered social engineering. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, adversaries are not directly sending malware to a victim vice relying on [User Execution](https://attack.mitre.org/techniques/T1204) for delivery and execution.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, adversaries are not directly sending malware to a victim vice relying on [User Execution](https://attack.mitre.org/techniques/T1204) for delivery and execution. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation:

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools ([Remote Access Software](https://attack.mitre.org/techniques/T1219))

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools ([Remote Access Software](https://attack.mitre.org/techniques/T1219)) ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input:
onto their computer.(Citation: Unit42 Luna Moth)

Adversaries may also combine voice phishing with [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621) in order to trick users into divulging MFA credentials or accepting authentication prompts.(Citation: Proofpoint Vishing)

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: onto their computer.(Citation: Unit42 Luna Moth)

Adversaries may also combine voice phishing with [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621) in order to trick users into divulging MFA credentials or accepting authentication prompts.(Citation: Proofpoint Vishing) ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing via service is a specific variant of spearphishing.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing via service is a specific variant of spearphishing. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: These services are more likely to have a less-strict security policy than an enterprise.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These services are more likely to have a less-strict security policy than an enterprise. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries will create fake social media accounts and message employees for potential job opportunities.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries will create fake social media accounts and message employees for potential job opportunities. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: The adversary can then send malicious links or attachments through these services.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The adversary can then send malicious links or attachments through these services. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. ### Response: T1566.003.


Instruction: List the MITRE techniques contained in the text.

Input: If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.

Output: T1566.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working. ### Response: T1566.003.