Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to remove such artifacts.(Citation: F-Secure BlackEnergy 2014)

Output: T1553.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to remove such artifacts.(Citation: F-Secure BlackEnergy 2014) ### Response: T1553.006.


Instruction: List the MITRE techniques contained in the text.

Input: To gain access to kernel memory to modify variables related to signature checks, such as modifying g_CiOptions to disable Driver Signature Enforcement, adversaries may conduct [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) using a signed, but vulnerable driver.(Citation:

Output: T1553.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To gain access to kernel memory to modify variables related to signature checks, such as modifying g_CiOptions to disable Driver Signature Enforcement, adversaries may conduct [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) using a signed, but vulnerable driver.(Citation: ### Response: T1553.006.


Instruction: List the MITRE techniques contained in the text.

Input: Unit42 AcidBox June 2020)(Citation: GitHub Turla Driver Loader)

Output: T1553.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit42 AcidBox June 2020)(Citation: GitHub Turla Driver Loader) ### Response: T1553.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may deploy a container into an environment to facilitate execution or evade defenses.

Output: T1610

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may deploy a container into an environment to facilitate execution or evade defenses. ### Response: T1610.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware.

Output: T1610

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. ### Response: T1610.


Instruction: List the MITRE techniques contained in the text.

Input: In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment.

Output: T1610

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. ### Response: T1610.


Instruction: List the MITRE techniques contained in the text.

Input: Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation:

Output: T1610

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: ### Response: T1610.


Instruction: List the MITRE techniques contained in the text.

Input: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines)

Output: T1610

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) ### Response: T1610.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)

Output: T1610

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts) ### Response: T1610.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may delete files left behind by the actions of their intrusion activity.

Output: T1107

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may delete files left behind by the actions of their intrusion activity. ### Response: T1107.


Instruction: List the MITRE techniques contained in the text.

Input: Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.

Output: T1107

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. ### Response: T1107.


Instruction: List the MITRE techniques contained in the text.

Input: Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Output: T1107

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. ### Response: T1107.


Instruction: List the MITRE techniques contained in the text.

Input: There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.

Output: T1107

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. ### Response: T1107.


Instruction: List the MITRE techniques contained in the text.

Input: Examples include native [cmd](https://attack.mitre.org/software/S0106) functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools.

Output: T1107

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples include native [cmd](https://attack.mitre.org/software/S0106) functions such as DEL, secure deletion tools such as Windows Sysinternals SDelete, or other third-party file deletion tools. ### Response: T1107.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Trend Micro APT Attack Tools)

Output: T1107

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Trend Micro APT Attack Tools) ### Response: T1107.


Instruction: List the MITRE techniques contained in the text.

Input: Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.

Output: T1145

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. ### Response: T1145.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Wikipedia Public Key Crypto)

Output: T1145

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wikipedia Public Key Crypto) ### Response: T1145.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather private keys from compromised systems for use in authenticating to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email.

Output: T1145

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather private keys from compromised systems for use in authenticating to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email. ### Response: T1145.


Instruction: List the MITRE techniques contained in the text.

Input: Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.

Output: T1145

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. ### Response: T1145.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows.

Output: T1145

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. ### Response: T1145.


Instruction: List the MITRE techniques contained in the text.

Input: Private keys should require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line.

Output: T1145

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Private keys should require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line. ### Response: T1145.


Instruction: List the MITRE techniques contained in the text.

Input: Adversary tools have been discovered that search compromised systems for file extensions relating to cryptographic keys and certificates.

Output: T1145

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversary tools have been discovered that search compromised systems for file extensions relating to cryptographic keys and certificates. ### Response: T1145.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Kaspersky Careto) (Citation: Palo Alto Prince of Persia)

Output: T1145

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Kaspersky Careto) (Citation: Palo Alto Prince of Persia) ### Response: T1145.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution. ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access.

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access. ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification.

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification. ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API.

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Reg) Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API. ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API.

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API. ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Reghide NOV 2006)

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Reghide NOV 2006) ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence. ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: TrendMicro POWELIKS AUG 2014)

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: TrendMicro POWELIKS AUG 2014) ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: SpectorOps Hiding Reg Jul 2017)

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: SpectorOps Hiding Reg Jul 2017) ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: The Registry of a remote system may be modified to aid in execution of files as part of lateral movement.

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Registry of a remote system may be modified to aid in execution of files as part of lateral movement. ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: It requires the remote Registry service to be running on the target system.

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It requires the remote Registry service to be running on the target system. ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft Remote)

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Remote) ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication.

Output: T1112

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication. ### Response: T1112.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input: When operating systems boot up, they can start processes that perform background system functions.

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When operating systems boot up, they can start processes that perform background system functions. ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input: On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons)

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons) ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence.

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input:
Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.

Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges.

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.

Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection)

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection) ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.(Citation: AppleDocs Launch Agent Daemons)(Citation: Methods of Mac Malware Persistence)(Citation: launchd Keywords for plists)

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.(Citation: AppleDocs Launch Agent Daemons)(Citation: Methods of Mac Malware Persistence)(Citation: launchd Keywords for plists) ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install a Launch Daemon configured to execute at startup by using the RunAtLoad parameter set to true and the Program parameter set to the malicious executable path.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install a Launch Daemon configured to execute at startup by using the RunAtLoad parameter set to true and the Program parameter set to the malicious executable path. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: The daemon name may be disguised by using a name from a related operating system or benign software (i.e. [Masquerading](https://attack.mitre.org/techniques/T1036)).

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The daemon name may be disguised by using a name from a related operating system or benign software (i.e. [Masquerading](https://attack.mitre.org/techniques/T1036)). ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: When the Launch Daemon is executed, the program inherits administrative permissions.(Citation: WireLurker)(Citation: OSX Malware Detection)

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the Launch Daemon is executed, the program inherits administrative permissions.(Citation: WireLurker)(Citation: OSX Malware Detection) ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, system configuration changes (such as the installation of third party package managing software) may cause folders such as usr/local/bin to become globally writeable.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, system configuration changes (such as the installation of third party package managing software) may cause folders such as usr/local/bin to become globally writeable. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: So, it is possible for poor configurations to allow an adversary to modify executables referenced by current Launch Daemon's plist files.(Citation: LaunchDaemon Hijacking)(Citation: sentinelone macos persist Jun 2019)

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: So, it is possible for poor configurations to allow an adversary to modify executables referenced by current Launch Daemon's plist files.(Citation: LaunchDaemon Hijacking)(Citation: sentinelone macos persist Jun 2019) ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment.

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services. ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure.

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, the HeadBucket API to determine a bucket’s existence along with access permissions of the request sender, or the GetPublicAccessBlock

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, the HeadBucket API to determine a bucket’s existence along with access permissions of the request sender, or the GetPublicAccessBlock ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation:

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: AWS Get Public Access Block)(Citation: AWS Head Bucket)

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AWS Get Public Access Block)(Citation: AWS Head Bucket) ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project (Citation: Google Compute Instances), and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI)

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project (Citation: Google Compute Instances), and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI) ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation:

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation: ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: Malwarebytes OSINT Leaky Buckets - Hioureas)

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malwarebytes OSINT Leaky Buckets - Hioureas) ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS)

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication.

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication. ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources.

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources. ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AWS Describe DB Instances)

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AWS Describe DB Instances) ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use this information to determine the potential value of databases and discover the requirements to access them.

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use this information to determine the potential value of databases and discover the requirements to access them. ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves.

Output: T1580

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves. ### Response: T1580.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for common password storage locations to obtain user credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for common password storage locations to obtain user credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation:

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;.

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key.(Citation: Microsoft CryptUnprotectData April 2018)

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key.(Citation: Microsoft CryptUnprotectData April 2018) ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017)

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the [Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004).

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the [Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004). ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)

After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access.

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)

After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator). ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: How the operating system locates libraries to be used by a program can also be intercepted.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: How the operating system locates libraries to be used by a program can also be intercepted. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Output: T1574

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads. ### Response: T1574.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs.

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input: Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program. ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input: Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path.

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input: Unlike [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), the search order differs depending on the method that is used to execute the program.

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unlike [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), the search order differs depending on the method that is used to execute the program. ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Microsoft CreateProcess) (Citation: Windows NT Command Shell) (Citation: Microsoft WinExec)

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft CreateProcess) (Citation: Windows NT Command Shell) (Citation: Microsoft WinExec) ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input: However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory.

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory. ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input: For example, "example.exe" runs "cmd.exe" with the command-line argument net user.

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, "example.exe" runs "cmd.exe" with the command-line argument net user. ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net.

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net. ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input: In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then <code>cmd.exe /C

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then <code>cmd.exe /C ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input: net user</code> will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT.

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: net user</code> will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT. ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft Environment Property)

Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).

Output: T1574.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Environment Property)

Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001). ### Response: T1574.008.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users.

Output: T1491.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. ### Response: T1491.002.


Instruction: List the MITRE techniques contained in the text.

Input: [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity.

Output: T1491.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. ### Response: T1491.002.


Instruction: List the MITRE techniques contained in the text.

Input: Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site)

Output: T1491.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) ### Response: T1491.002.


Instruction: List the MITRE techniques contained in the text.

Input: [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government.

Output: T1491.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. ### Response: T1491.002.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation:

Output: T1491.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: ### Response: T1491.002.


Instruction: List the MITRE techniques contained in the text.

Input: Trend Micro Deep Dive Into Defacement)

Output: T1491.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Trend Micro Deep Dive Into Defacement) ### Response: T1491.002.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

Output: T1491.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. ### Response: T1491.001.


Instruction: List the MITRE techniques contained in the text.

Input: This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)

Output: T1491.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster) ### Response: T1491.001.


Instruction: List the MITRE techniques contained in the text.

Input: Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages.

Output: T1491.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. ### Response: T1491.001.


Instruction: List the MITRE techniques contained in the text.

Input: Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)

Output: T1491.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware) ### Response: T1491.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content.

Output: T1491

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. ### Response: T1491.


Instruction: List the MITRE techniques contained in the text.

Input: Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion.

Output: T1491

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. ### Response: T1491.


Instruction: List the MITRE techniques contained in the text.

Input: Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.

Output: T1491

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages. ### Response: T1491.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create cloud instances in unused geographic service regions in order to evade detection.

Output: T1535

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create cloud instances in unused geographic service regions in order to evade detection. ### Response: T1535.


Instruction: List the MITRE techniques contained in the text.

Input: Access is usually obtained through compromising accounts used to manage cloud infrastructure.

Output: T1535

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Access is usually obtained through compromising accounts used to manage cloud infrastructure. ### Response: T1535.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements.

Output: T1535

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. ### Response: T1535.


Instruction: List the MITRE techniques contained in the text.

Input: Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions.

Output: T1535

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions. ### Response: T1535.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary creates resources in an unused region, they may be able to operate undetected.

Output: T1535

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary creates resources in an unused region, they may be able to operate undetected. ### Response: T1535.


Instruction: List the MITRE techniques contained in the text.

Input: A variation on this behavior takes advantage of differences in functionality across cloud regions.

Output: T1535

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variation on this behavior takes advantage of differences in functionality across cloud regions. ### Response: T1535.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity.

Output: T1535

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity. ### Response: T1535.


Instruction: List the MITRE techniques contained in the text.

Input: An example of adversary use of unused AWS regions is to mine cryptocurrency through [Resource Hijacking](https://attack.mitre.org/techniques/T1496), which can cost organizations substantial amounts of money over time depending on the processing power used.(Citation: CloudSploit - Unused AWS Regions)

Output: T1535

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An example of adversary use of unused AWS regions is to mine cryptocurrency through [Resource Hijacking](https://attack.mitre.org/techniques/T1496), which can cost organizations substantial amounts of money over time depending on the processing power used.(Citation: CloudSploit - Unused AWS Regions) ### Response: T1535.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040),

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)).

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)). ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics) ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner)

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials and session cookies.(Citation: volexity_0day_sophos_FW)

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials and session cookies.(Citation: volexity_0day_sophos_FW) ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att)

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att) ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to [Impair Defenses](https://attack.mitre.org/techniques/T1562) and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498).

Output: T1557

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to [Impair Defenses](https://attack.mitre.org/techniques/T1562) and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498). ### Response: T1557.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131)

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131) ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input:
The typical server-client interaction is as follows:

1.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The typical server-client interaction is as follows:

1. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: The client broadcasts a `DISCOVER` message.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The client broadcasts a `DISCOVER` message. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: 2. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: The server responds with an `OFFER` message, which includes an available network address.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The server responds with an `OFFER` message, which includes an available network address. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: 3. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: The client broadcasts a `REQUEST` message, which includes the network address offered.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The client broadcasts a `REQUEST` message, which includes the network address offered. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: 4. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: The server acknowledges with an `ACK` message and the client receives the network configuration parameters.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The server acknowledges with an `ACK` message and the client receives the network configuration parameters. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g)

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g) ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002))

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002)) ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool.

Output: T1557.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool. ### Response: T1557.003.


Instruction: List the MITRE techniques contained in the text.

Input: macOS and OS X applications send AppleEvent messages to each other for interprocess communications (IPC).

Output: T1155

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: macOS and OS X applications send AppleEvent messages to each other for interprocess communications (IPC). ### Response: T1155.


Instruction: List the MITRE techniques contained in the text.

Input: These messages can be easily scripted with AppleScript for local or remote IPC.

Output: T1155

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These messages can be easily scripted with AppleScript for local or remote IPC. ### Response: T1155.


Instruction: List the MITRE techniques contained in the text.

Input: Osascript executes AppleScript and any other Open Scripting Architecture (OSA) language scripts.

Output: T1155

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Osascript executes AppleScript and any other Open Scripting Architecture (OSA) language scripts. ### Response: T1155.


Instruction: List the MITRE techniques contained in the text.

Input: A list of OSA languages installed on a system can be found by using the osalang program.

Output: T1155

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A list of OSA languages installed on a system can be found by using the osalang program. ### Response: T1155.


Instruction: List the MITRE techniques contained in the text.

Input: AppleEvent messages can be sent independently or as part of a script.

Output: T1155

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AppleEvent messages can be sent independently or as part of a script. ### Response: T1155.