Instruction: List the MITRE techniques contained in the text.

Input: The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.

Output: T1542.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. ### Response: T1542.001.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI)

Output: T1542.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) ### Response: T1542.001.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: About UEFI)

System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity.

Output: T1542.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: About UEFI)

System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity. ### Response: T1542.001.


Instruction: List the MITRE techniques contained in the text.

Input: Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.

Output: T1542.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect. ### Response: T1542.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: During the booting process of a computer, firmware and various startup services are loaded before the operating system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During the booting process of a computer, firmware and various startup services are loaded before the operating system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting)

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting) ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.

Output: T1542

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses. ### Response: T1542.


Instruction: List the MITRE techniques contained in the text.

Input: **This technique has been deprecated.

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **This technique has been deprecated. ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input: Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate. ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input:
**

Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual.

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **

Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input: Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources.

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input: Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs.

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input: Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts.

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common scripting languages for Windows include VBScript and [PowerShell](https://attack.mitre.org/techniques/T1086) but could also be in the form of command-line batch scripts. ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input: Scripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened.

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them. ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input: Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike.

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input: Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses.

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input: Some adversaries are known to use PowerShell.

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some adversaries are known to use PowerShell. ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Alperovitch 2014)

Output: T1064

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Alperovitch 2014) ### Response: T1064.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry.

Output: T1612

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. ### Response: T1612.


Instruction: List the MITRE techniques contained in the text.

Input: A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)

Output: T1612

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image) ### Response: T1612.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts)(Citation:

Output: T1612

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts)(Citation: ### Response: T1612.


Instruction: List the MITRE techniques contained in the text.

Input: Aqua Security Cloud Native Threat Report June 2021)

Output: T1612

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Aqua Security Cloud Native Threat Report June 2021) ### Response: T1612.


Instruction: List the MITRE techniques contained in the text.

Input: If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image.

Output: T1612

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. ### Response: T1612.


Instruction: List the MITRE techniques contained in the text.

Input: If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment.

Output: T1612

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment. ### Response: T1612.


Instruction: List the MITRE techniques contained in the text.

Input: **This technique has been deprecated and should no longer be used.

Output: T1051

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **This technique has been deprecated and should no longer be used. ### Response: T1051.


Instruction: List the MITRE techniques contained in the text.

Input:
**

Adversaries may add malicious content to an internally accessible website through an open network file share that contains the website's webroot or Web content directory (Citation: Microsoft Web Root OCT 2016) (Citation: Apache Server 2018) and then browse to that content with a Web browser to cause the server to execute the malicious content.

Output: T1051

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **

Adversaries may add malicious content to an internally accessible website through an open network file share that contains the website's webroot or Web content directory (Citation: Microsoft Web Root OCT 2016) (Citation: Apache Server 2018) and then browse to that content with a Web browser to cause the server to execute the malicious content. ### Response: T1051.


Instruction: List the MITRE techniques contained in the text.

Input: The malicious content will typically run under the context and permissions of the Web server process, often resulting in local system or administrative privileges, depending on how the Web server is configured.

Output: T1051

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The malicious content will typically run under the context and permissions of the Web server process, often resulting in local system or administrative privileges, depending on how the Web server is configured. ### Response: T1051.


Instruction: List the MITRE techniques contained in the text.

Input: This mechanism of shared access and remote execution could be used for lateral movement to the system running the Web server.

Output: T1051

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This mechanism of shared access and remote execution could be used for lateral movement to the system running the Web server. ### Response: T1051.


Instruction: List the MITRE techniques contained in the text.

Input: For example, a Web server running PHP with an open network share could allow an adversary to upload a remote access tool and PHP script to execute the RAT on the system running the Web server when a specific page is visited.

Output: T1051

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, a Web server running PHP with an open network share could allow an adversary to upload a remote access tool and PHP script to execute the RAT on the system running the Web server when a specific page is visited. ### Response: T1051.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Webroot PHP 2011)

Output: T1051

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Webroot PHP 2011) ### Response: T1051.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Process injection is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process injection is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: These implementations exist for every major OS but are typically platform specific.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These implementations exist for every major OS but are typically platform specific. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.002.


Instruction: List the MITRE techniques contained in the text.

Input: PE injection is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PE injection is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.002.


Instruction: List the MITRE techniques contained in the text.

Input: PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread.

Output: T1055.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. ### Response: T1055.002.


Instruction: List the MITRE techniques contained in the text.

Input: The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode).

Output: T1055.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). ### Response: T1055.002.


Instruction: List the MITRE techniques contained in the text.

Input: The displacement of the injected code does introduce the additional requirement for functionality to remap memory references.

Output: T1055.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. ### Response: T1055.002.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Elastic Process Injection July 2017)

Output: T1055.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017) ### Response: T1055.002.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.002.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse verclsid.exe to proxy execution of malicious code.

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse verclsid.exe to proxy execution of malicious code. ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe)

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe) ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse verclsid.exe to execute malicious payloads.

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse verclsid.exe to execute malicious payloads. ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: This may be achieved by running <code>verclsid.exe /S /C

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may be achieved by running <code>verclsid.exe /S /C ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: {CLSID}</code>, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects.

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: {CLSID}</code>, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)).

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)). ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation:

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation: ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation:

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation: ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Nick Tyrer GitHub)

Output: T1218.012

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Nick Tyrer GitHub) ### Response: T1218.012.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise cloud accounts that can be used during targeting.

Output: T1586.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise cloud accounts that can be used during targeting. ### Response: T1586.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s.

Output: T1586.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. ### Response: T1586.003.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure.

Output: T1586.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. ### Response: T1586.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Compromising cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)

A variety of methods exist for compromising cloud accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, conducting [Password Spraying](https://attack.mitre.org/techniques/T1110/003) attacks, or attempting to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation:

Output: T1586.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromising cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)

A variety of methods exist for compromising cloud accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, conducting [Password Spraying](https://attack.mitre.org/techniques/T1110/003) attacks, or attempting to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation: ### Response: T1586.003.


Instruction: List the MITRE techniques contained in the text.

Input: MSTIC Nobelium Oct 2021)

Output: T1586.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: MSTIC Nobelium Oct 2021) ### Response: T1586.003.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to compromising cloud accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.

Output: T1586.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to compromising cloud accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. ### Response: T1586.003.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, adversaries may target privileged service provider accounts with the intent of leveraging a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) between service providers and their customers.(Citation: MSTIC Nobelium Oct 2021)

Output: T1586.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, adversaries may target privileged service provider accounts with the intent of leveraging a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) between service providers and their customers.(Citation: MSTIC Nobelium Oct 2021) ### Response: T1586.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise email accounts that can be used during targeting.

Output: T1586.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise email accounts that can be used during targeting. ### Response: T1586.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or large-scale spam email campaigns.

Output: T1586.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or large-scale spam email campaigns. ### Response: T1586.002.


Instruction: List the MITRE techniques contained in the text.

Input: Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona.

Output: T1586.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. ### Response: T1586.002.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).

Output: T1586.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)). ### Response: T1586.002.


Instruction: List the MITRE techniques contained in the text.

Input: A variety of methods exist for compromising email accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials.(Citation:

Output: T1586.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variety of methods exist for compromising email accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials.(Citation: ### Response: T1586.002.


Instruction: List the MITRE techniques contained in the text.

Input: AnonHBGary)(Citation: Microsoft DEV-0537)

Output: T1586.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AnonHBGary)(Citation: Microsoft DEV-0537) ### Response: T1586.002.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.

Output: T1586.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. ### Response: T1586.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may target compromising well-known email accounts or domains from which malicious spam or [Phishing](https://attack.mitre.org/techniques/T1566) emails may evade reputation-based email filtering rules.

Output: T1586.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may target compromising well-known email accounts or domains from which malicious spam or [Phishing](https://attack.mitre.org/techniques/T1566) emails may evade reputation-based email filtering rules. ### Response: T1586.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use a compromised email account to hijack existing email threads with targets of interest.

Output: T1586.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use a compromised email account to hijack existing email threads with targets of interest. ### Response: T1586.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise social media accounts that can be used during targeting.

Output: T1586.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise social media accounts that can be used during targeting. ### Response: T1586.001.


Instruction: List the MITRE techniques contained in the text.

Input: For operations incorporating social engineering, the utilization of an online persona may be important.

Output: T1586.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For operations incorporating social engineering, the utilization of an online persona may be important. ### Response: T1586.001.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than creating and cultivating social media profiles (i.e. [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001)), adversaries may compromise existing social media accounts.

Output: T1586.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than creating and cultivating social media profiles (i.e. [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001)), adversaries may compromise existing social media accounts. ### Response: T1586.001.


Instruction: List the MITRE techniques contained in the text.

Input: Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.

Output: T1586.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. ### Response: T1586.001.


Instruction: List the MITRE techniques contained in the text.

Input: A variety of methods exist for compromising social media accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).(Citation: AnonHBGary)

Output: T1586.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variety of methods exist for compromising social media accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) ### Response: T1586.001.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.

Output: T1586.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. ### Response: T1586.001.


Instruction: List the MITRE techniques contained in the text.

Input: Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.).

Output: T1586.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). ### Response: T1586.001.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.

Output: T1586.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. ### Response: T1586.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest.

Output: T1586.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest. ### Response: T1586.001.


Instruction: List the MITRE techniques contained in the text.

Input: These connections may be direct or may include trying to connect through others.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

Output: T1586.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These connections may be direct or may include trying to connect through others.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) ### Response: T1586.001.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).

Output: T1586.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)). ### Response: T1586.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise accounts with services that can be used during targeting.

Output: T1586

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise accounts with services that can be used during targeting. ### Response: T1586.


Instruction: List the MITRE techniques contained in the text.

Input: For operations incorporating social engineering, the utilization of an online persona may be important.

Output: T1586

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For operations incorporating social engineering, the utilization of an online persona may be important. ### Response: T1586.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts.

Output: T1586

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts. ### Response: T1586.


Instruction: List the MITRE techniques contained in the text.

Input: Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.

Output: T1586

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. ### Response: T1586.


Instruction: List the MITRE techniques contained in the text.

Input: A variety of methods exist for compromising accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials.(Citation:

Output: T1586

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A variety of methods exist for compromising accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials.(Citation: ### Response: T1586.


Instruction: List the MITRE techniques contained in the text.

Input: AnonHBGary)(Citation: Microsoft DEV-0537)

Output: T1586

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AnonHBGary)(Citation: Microsoft DEV-0537) ### Response: T1586.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.

Output: T1586

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. ### Response: T1586.


Instruction: List the MITRE techniques contained in the text.

Input: Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.).

Output: T1586

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). ### Response: T1586.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.

Output: T1586

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. ### Response: T1586.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may directly leverage compromised email accounts for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).

Output: T1586

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may directly leverage compromised email accounts for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566). ### Response: T1586.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse system services or daemons to execute commands or programs.

Output: T1569

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse system services or daemons to execute commands or programs. ### Response: T1569.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can execute malicious content by interacting with or creating services either locally or remotely.

Output: T1569

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can execute malicious content by interacting with or creating services either locally or remotely. ### Response: T1569.


Instruction: List the MITRE techniques contained in the text.

Input: Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.

Output: T1569

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution. ### Response: T1569.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse launchctl to execute commands or programs.

Output: T1569.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse launchctl to execute commands or programs. ### Response: T1569.001.


Instruction: List the MITRE techniques contained in the text.

Input: Launchctl interfaces with launchd, the service management framework for macOS.

Output: T1569.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launchctl interfaces with launchd, the service management framework for macOS. ### Response: T1569.001.


Instruction: List the MITRE techniques contained in the text.

Input: Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man)

Output: T1569.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man) ### Response: T1569.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.

Output: T1569.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. ### Response: T1569.001.


Instruction: List the MITRE techniques contained in the text.

Input: Common subcommands include: launchctl load,launchctl unload, and launchctl start.

Output: T1569.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common subcommands include: launchctl load,launchctl unload, and launchctl start. ### Response: T1569.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use scripts or manually run the commands <code>launchctl load -w

Output: T1569.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use scripts or manually run the commands <code>launchctl load -w ### Response: T1569.001.


Instruction: List the MITRE techniques contained in the text.

Input: "%s/Library/LaunchAgents/%s" or /bin/launchctl load to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques)

Output: T1569.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: "%s/Library/LaunchAgents/%s" or /bin/launchctl load to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques) ### Response: T1569.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise third-party infrastructure that can be used during targeting.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise third-party infrastructure that can be used during targeting. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation:

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation:

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Use of compromised infrastructure allows adversaries to stage, launch, and execute operations.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Phishing](https://attack.mitre.org/techniques/T1566) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: campaigns.(Citation: FireEye DNS Hijack 2019)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: campaigns.(Citation: FireEye DNS Hijack 2019) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them.

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)

Output: T1584

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig) ### Response: T1584.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting.

Output: T1584.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. ### Response: T1584.005.


Instruction: List the MITRE techniques contained in the text.

Input: A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imperva DDoS for Hire) Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).

Output: T1584.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imperva DDoS for Hire) Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS). ### Response: T1584.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005). ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2.

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Powershell Remote Commands)(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Powershell Remote Commands)(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Cisco IOS Software Integrity Assurance - Command History)(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cisco IOS Software Integrity Assurance - Command History)(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Remote Shell Execution in Python)

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote Shell Execution in Python) ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions.

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: CLIs typically contain various permission levels required for different commands.

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CLIs typically contain various permission levels required for different commands. ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS.

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or [SSH](https://attack.mitre.org/techniques/T1021/004).

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or [SSH](https://attack.mitre.org/techniques/T1021/004). ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use the network CLI to change how network devices behave and operate.

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use the network CLI to change how network devices behave and operate. ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.(Citation: Cisco Synful Knock Evolution)

Output: T1059.008

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.(Citation: Cisco Synful Knock Evolution) ### Response: T1059.008.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search compromised systems to find and obtain insecurely stored credentials.

Output: T1552

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search compromised systems to find and obtain insecurely stored credentials. ### Response: T1552.


Instruction: List the MITRE techniques contained in the text.

Input: These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).

Output: T1552

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)). ### Response: T1552.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search the bash command history on compromised systems for insecurely stored credentials. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Bash keeps track of the commands users type on the command-line with the "history" utility.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Bash keeps track of the commands users type on the command-line with the "history" utility. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Once a user logs out, the history is flushed to the user’s <code>.bash_history</code> file.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once a user logs out, the history is flushed to the user’s <code>.bash_history</code> file. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: For each user, this file resides at the same location: <code>~/.bash_history</code>.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For each user, this file resides at the same location: <code>~/.bash_history</code>. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Typically, this file keeps track of the user’s last 500 commands.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typically, this file keeps track of the user’s last 500 commands. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can abuse this by looking through the file for potential credentials.

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can abuse this by looking through the file for potential credentials. ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: External to DA, the OS X Way)

Output: T1552.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: External to DA, the OS X Way) ### Response: T1552.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Output: T1562

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. ### Response: T1562.