Instruction: List the MITRE techniques contained in the text.

Input: Cisco IOS Software Integrity Assurance - Command History)(Citation:

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cisco IOS Software Integrity Assurance - Command History)(Citation: ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Remote Shell Execution in Python)

Output: T1059

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote Shell Execution in Python) ### Response: T1059.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse various implementations of JavaScript for execution.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse various implementations of JavaScript for execution. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS)

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS) ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: JScript is the Microsoft implementation of the same scripting standard.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: JScript is the Microsoft implementation of the same scripting standard. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input:
JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts)

JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts)

JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: As of OSX 10.10, OSA only supports two languages, JXA and [AppleScript](https://attack.mitre.org/techniques/T1059/002).

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As of OSX 10.10, OSA only supports two languages, JXA and [AppleScript](https://attack.mitre.org/techniques/T1059/002). ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.(Citation:

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.(Citation: ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Apple About Mac Scripting 2016)(Citation:

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple About Mac Scripting 2016)(Citation: ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: SpecterOps JXA 2020)(Citation:

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SpecterOps JXA 2020)(Citation: ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: SentinelOne macOS Red Team)(Citation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec macOS JXA and VSCode)

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SentinelOne macOS Red Team)(Citation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec macOS JXA and VSCode) ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse various implementations of JavaScript to execute various behaviors.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse various implementations of JavaScript to execute various behaviors. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or downloading and executing these script files as secondary payloads.

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or downloading and executing these script files as secondary payloads. ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).

Output: T1059.007

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027). ### Response: T1059.007.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's networks that can be used during targeting.

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's networks that can be used during targeting. ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation:

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Circl Passive DNS)

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Circl Passive DNS) ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Output: T1590

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)). ### Response: T1590.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's DNS that can be used during targeting.

Output: T1590.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's DNS that can be used during targeting. ### Response: T1590.002.


Instruction: List the MITRE techniques contained in the text.

Input: DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.

Output: T1590.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. ### Response: T1590.002.


Instruction: List the MITRE techniques contained in the text.

Input: DNS, MX, TXT, and SPF records may also reveal the use of third party cloud and SaaS providers, such as Office 365, G Suite, Salesforce, or Zendesk.(Citation:

Output: T1590.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DNS, MX, TXT, and SPF records may also reveal the use of third party cloud and SaaS providers, such as Office 365, G Suite, Salesforce, or Zendesk.(Citation: ### Response: T1590.002.


Instruction: List the MITRE techniques contained in the text.

Input: Sean Metcalf Twitter DNS Records)

Output: T1590.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sean Metcalf Twitter DNS Records) ### Response: T1590.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as querying or otherwise collecting details via [DNS/Passive DNS](https://attack.mitre.org/techniques/T1596/001).

Output: T1590.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as querying or otherwise collecting details via [DNS/Passive DNS](https://attack.mitre.org/techniques/T1596/001). ### Response: T1590.002.


Instruction: List the MITRE techniques contained in the text.

Input: DNS information may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: DNS Dumpster)(Citation:

Output: T1590.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: DNS information may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: DNS Dumpster)(Citation: ### Response: T1590.002.


Instruction: List the MITRE techniques contained in the text.

Input: Circl Passive DNS)

Output: T1590.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Circl Passive DNS) ### Response: T1590.002.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Active Scanning](https://attack.mitre.org/techniques/T1595)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or

Output: T1590.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Active Scanning](https://attack.mitre.org/techniques/T1595)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or ### Response: T1590.002.


Instruction: List the MITRE techniques contained in the text.

Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).

Output: T1590.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)). ### Response: T1590.002.


Instruction: List the MITRE techniques contained in the text.

Input: Systemd services can be used to establish persistence on a Linux system.

Output: T1501

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Systemd services can be used to establish persistence on a Linux system. ### Response: T1501.


Instruction: List the MITRE techniques contained in the text.

Input: The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd 29SEP2018)

Output: T1501

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd 29SEP2018) ### Response: T1501.


Instruction: List the MITRE techniques contained in the text.

Input: Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.

Output: T1501

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems. ### Response: T1501.


Instruction: List the MITRE techniques contained in the text.

Input: Systemd utilizes configuration files known as service units to control how services boot and under what conditions.

Output: T1501

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Systemd utilizes configuration files known as service units to control how services boot and under what conditions. ### Response: T1501.


Instruction: List the MITRE techniques contained in the text.

Input: By default, these unit files are stored in the /etc/systemd/system and /usr/lib/systemd/system directories and have the file extension .service.

Output: T1501

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, these unit files are stored in the /etc/systemd/system and /usr/lib/systemd/system directories and have the file extension .service. ### Response: T1501.


Instruction: List the MITRE techniques contained in the text.

Input: Each service unit file may contain numerous directives that can execute system commands.

Output: T1501

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Each service unit file may contain numerous directives that can execute system commands. ### Response: T1501.


Instruction: List the MITRE techniques contained in the text.

Input: * ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands when a services is started manually by 'systemctl' or on system start if the service is set to automatically start.

Output: T1501

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands when a services is started manually by 'systemctl' or on system start if the service is set to automatically start. ### Response: T1501.


Instruction: List the MITRE techniques contained in the text.

Input: * ExecReload directive covers when a service restarts.

Output: T1501

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ExecReload directive covers when a service restarts. ### Response: T1501.


Instruction: List the MITRE techniques contained in the text.

Input: * ExecStop and ExecStopPost directives cover when a service is stopped or manually by 'systemctl'.

Output: T1501

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ExecStop and ExecStopPost directives cover when a service is stopped or manually by 'systemctl'. ### Response: T1501.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at recurring intervals, such as at system boot.(Citation: Anomali Rocke March 2019)(Citation: gist Arch package compromise 10JUL2018)(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018)

Output: T1501

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at recurring intervals, such as at system boot.(Citation: Anomali Rocke March 2019)(Citation: gist Arch package compromise 10JUL2018)(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) ### Response: T1501.


Instruction: List the MITRE techniques contained in the text.

Input: While adversaries typically require root privileges to create/modify service unit files in the /etc/systemd/system and /usr/lib/systemd/system directories, low privilege users can create/modify service unit files in directories such as ~/.config/systemd/user/ to achieve user-level persistence.(Citation: Rapid7 Service Persistence 22JUNE2016)

Output: T1501

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: While adversaries typically require root privileges to create/modify service unit files in the /etc/systemd/system and /usr/lib/systemd/system directories, low privilege users can create/modify service unit files in directories such as ~/.config/systemd/user/ to achieve user-level persistence.(Citation: Rapid7 Service Persistence 22JUNE2016) ### Response: T1501.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges)

Output: T1514

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) ### Response: T1514.


Instruction: List the MITRE techniques contained in the text.

Input: The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating.

Output: T1514

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. ### Response: T1514.


Instruction: List the MITRE techniques contained in the text.

Input: This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.

Output: T1514

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified. ### Response: T1514.


Instruction: List the MITRE techniques contained in the text.

Input: Although this API is deprecated, it still fully functions in the latest releases of macOS.

Output: T1514

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Although this API is deprecated, it still fully functions in the latest releases of macOS. ### Response: T1514.


Instruction: List the MITRE techniques contained in the text.

Input: When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made.

Output: T1514

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. ### Response: T1514.


Instruction: List the MITRE techniques contained in the text.

Input: The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.

Output: T1514

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges. ### Response: T1514.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse AuthorizationExecuteWithPrivileges to obtain root privileges in order to install malicious software on victims and install persistence mechanisms.(Citation: Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer Feb 2019)(Citation:

Output: T1514

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse AuthorizationExecuteWithPrivileges to obtain root privileges in order to install malicious software on victims and install persistence mechanisms.(Citation: Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer Feb 2019)(Citation: ### Response: T1514.


Instruction: List the MITRE techniques contained in the text.

Input: OSX Coldroot RAT)

Output: T1514

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: OSX Coldroot RAT) ### Response: T1514.


Instruction: List the MITRE techniques contained in the text.

Input: This technique may be combined with [Masquerading](https://attack.mitre.org/techniques/T1036) to trick the user into granting escalated privileges to malicious code.(Citation: Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer Feb 2019)

Output: T1514

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique may be combined with [Masquerading](https://attack.mitre.org/techniques/T1036) to trick the user into granting escalated privileges to malicious code.(Citation: Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer Feb 2019) ### Response: T1514.


Instruction: List the MITRE techniques contained in the text.

Input: This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.(Citation: Death by 1000 installers; it's all broken!)

Output: T1514

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.(Citation: Death by 1000 installers; it's all broken!) ### Response: T1514.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Output: T1123

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information. ### Response: T1123.


Instruction: List the MITRE techniques contained in the text.

Input: Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio.

Output: T1123

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. ### Response: T1123.


Instruction: List the MITRE techniques contained in the text.

Input: Audio files may be written to disk and exfiltrated later.

Output: T1123

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Audio files may be written to disk and exfiltrated later. ### Response: T1123.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.(Citation: AppleDocs Launch Agent Daemons)(Citation: Methods of Mac Malware Persistence)(Citation: launchd Keywords for plists)

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.(Citation: AppleDocs Launch Agent Daemons)(Citation: Methods of Mac Malware Persistence)(Citation: launchd Keywords for plists) ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install a Launch Daemon configured to execute at startup by using the RunAtLoad parameter set to true and the Program parameter set to the malicious executable path.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install a Launch Daemon configured to execute at startup by using the RunAtLoad parameter set to true and the Program parameter set to the malicious executable path. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: The daemon name may be disguised by using a name from a related operating system or benign software (i.e. [Masquerading](https://attack.mitre.org/techniques/T1036)).

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The daemon name may be disguised by using a name from a related operating system or benign software (i.e. [Masquerading](https://attack.mitre.org/techniques/T1036)). ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: When the Launch Daemon is executed, the program inherits administrative permissions.(Citation: WireLurker)(Citation: OSX Malware Detection)

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When the Launch Daemon is executed, the program inherits administrative permissions.(Citation: WireLurker)(Citation: OSX Malware Detection) ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, system configuration changes (such as the installation of third party package managing software) may cause folders such as usr/local/bin to become globally writeable.

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, system configuration changes (such as the installation of third party package managing software) may cause folders such as usr/local/bin to become globally writeable. ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: So, it is possible for poor configurations to allow an adversary to modify executables referenced by current Launch Daemon's plist files.(Citation: LaunchDaemon Hijacking)(Citation: sentinelone macos persist Jun 2019)

Output: T1543.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: So, it is possible for poor configurations to allow an adversary to modify executables referenced by current Launch Daemon's plist files.(Citation: LaunchDaemon Hijacking)(Citation: sentinelone macos persist Jun 2019) ### Response: T1543.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

Output: T1543.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. ### Response: T1543.001.


Instruction: List the MITRE techniques contained in the text.

Input: When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation:

Output: T1543.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: ### Response: T1543.001.


Instruction: List the MITRE techniques contained in the text.

Input: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware)

Output: T1543.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware) ### Response: T1543.001.


Instruction: List the MITRE techniques contained in the text.

Input: Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Output: T1543.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks. ### Response: T1543.001.


Instruction: List the MITRE techniques contained in the text.

Input: Launch Agents can also be executed using the [Launchctl](https://attack.mitre.org/techniques/T1569/001) command.

Output: T1543.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launch Agents can also be executed using the [Launchctl](https://attack.mitre.org/techniques/T1569/001) command. ### Response: T1543.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive

Output: T1543.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive ### Response: T1543.001.


Instruction: List the MITRE techniques contained in the text.

Input: keys set to true.(Citation: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware Persistence)

Output: T1543.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: keys set to true.(Citation: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware Persistence) ### Response: T1543.001.


Instruction: List the MITRE techniques contained in the text.

Input: The Launch Agent name may be disguised by using a name from the related operating system or benign software.

Output: T1543.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Launch Agent name may be disguised by using a name from the related operating system or benign software. ### Response: T1543.001.


Instruction: List the MITRE techniques contained in the text.

Input: Launch Agents are created with user level privileges and execute with user level permissions.(Citation: OSX Malware Detection)(Citation: OceanLotus for OS X)

Output: T1543.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Launch Agents are created with user level privileges and execute with user level permissions.(Citation: OSX Malware Detection)(Citation: OceanLotus for OS X) ### Response: T1543.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence.

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input: Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014)

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014) ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input: Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible. ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input: Systemd utilizes unit configuration files with the `.service` file extension to encode information about a service's process.

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Systemd utilizes unit configuration files with the `.service` file extension to encode information about a service's process. ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input: By default, system level unit files are stored in the `/systemd/system` directory of the root owned directories (`/`).

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, system level unit files are stored in the `/systemd/system` directory of the root owned directories (`/`). ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input:
User level unit files are stored in the `/systemd/user` directories of the user owned directories (`$HOME`).(Citation: lambert systemd 2022)

Inside the `.service` unit files, the following directives are used to execute commands:(Citation: freedesktop systemd.service)

* `ExecStart`, `ExecStartPre`, and `ExecStartPost` directives execute when a service is started manually by `systemctl` or on system start if the service is set to automatically start.

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: User level unit files are stored in the `/systemd/user` directories of the user owned directories (`$HOME`).(Citation: lambert systemd 2022)

Inside the `.service` unit files, the following directives are used to execute commands:(Citation: freedesktop systemd.service)

* `ExecStart`, `ExecStartPre`, and `ExecStartPost` directives execute when a service is started manually by `systemctl` or on system start if the service is set to automatically start. ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input: * `ExecReload` directive executes when a service restarts.

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * `ExecReload` directive executes when a service restarts. ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input: * `ExecStop`, `ExecStopPre`, and `ExecStopPost` directives execute when a service is stopped.

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * `ExecStop`, `ExecStopPre`, and `ExecStopPost` directives execute when a service is stopped. ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have created new service files, altered the commands a `.service` file’s directive executes, and modified the user directive a `.service` file executes as, which could result in privilege escalation.

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have created new service files, altered the commands a `.service` file’s directive executes, and modified the user directive a `.service` file executes as, which could result in privilege escalation. ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also place symbolic links in these directories, enabling systemd to find these payloads regardless of where they reside on the filesystem.(Citation:

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also place symbolic links in these directories, enabling systemd to find these payloads regardless of where they reside on the filesystem.(Citation: ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input: Anomali Rocke March 2019)(Citation: airwalk backdoor unix systems)(Citation: Rapid7

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Anomali Rocke March 2019)(Citation: airwalk backdoor unix systems)(Citation: Rapid7 ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input: Service Persistence 22JUNE2016)

Output: T1543.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Service Persistence 22JUNE2016) ### Response: T1543.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input: When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system.

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input: Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API.

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API. ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use services to install and execute malicious drivers.

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use services to install and execute malicious drivers. ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via [Native API](https://attack.mitre.org/techniques/T1106) functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)), or by using command-line utilities such as `PnPUtil.exe`.(Citation: Symantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlayer February 2022)(Citation:

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via [Native API](https://attack.mitre.org/techniques/T1106) functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)), or by using command-line utilities such as `PnPUtil.exe`.(Citation: Symantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input: Unit42 AcidBox June 2020)

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit42 AcidBox June 2020) ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage these drivers as [Rootkit](https://attack.mitre.org/techniques/T1014)s to hide the presence of malicious activity on a system.

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage these drivers as [Rootkit](https://attack.mitre.org/techniques/T1014)s to hide the presence of malicious activity on a system. ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).(Citation: ESET InvisiMole June 2020)(Citation:

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).(Citation: ESET InvisiMole June 2020)(Citation: ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Unit42 AcidBox June 2020)

Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges.

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit42 AcidBox June 2020)

Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002).

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002). ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input: To make detection analysis more challenging, malicious services may also incorporate [Masquerade Task or Service](https://attack.mitre.org/techniques/T1036/004) (ex: using a service and/or payload name related to a legitimate OS or benign software component).

Output: T1543.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To make detection analysis more challenging, malicious services may also incorporate [Masquerade Task or Service](https://attack.mitre.org/techniques/T1036/004) (ex: using a service and/or payload name related to a legitimate OS or benign software component). ### Response: T1543.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input: When operating systems boot up, they can start processes that perform background system functions.

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When operating systems boot up, they can start processes that perform background system functions. ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input: On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons)

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons) ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence.

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input:
Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.

Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges.

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.

Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection)

Output: T1543

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection) ### Response: T1543.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage external-facing remote services to initially access and/or persist within a network.

Output: T1133

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage external-facing remote services to initially access and/or persist within a network. ### Response: T1133.


Instruction: List the MITRE techniques contained in the text.

Input: Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations.

Output: T1133

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. ### Response: T1133.


Instruction: List the MITRE techniques contained in the text.

Input: There are often remote service gateways that manage connections and credential authentication for these services.

Output: T1133

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are often remote service gateways that manage connections and credential authentication for these services. ### Response: T1133.


Instruction: List the MITRE techniques contained in the text.

Input:
Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop)

Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging)

Output: T1133

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop)

Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) ### Response: T1133.


Instruction: List the MITRE techniques contained in the text.

Input: Access to remote services may be used as a redundant or persistent access mechanism during an operation.

Output: T1133

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Access to remote services may be used as a redundant or persistent access mechanism during an operation. ### Response: T1133.


Instruction: List the MITRE techniques contained in the text.

Input: Access may also be gained through an exposed service that doesn’t require authentication.

Output: T1133

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Access may also be gained through an exposed service that doesn’t require authentication. ### Response: T1133.


Instruction: List the MITRE techniques contained in the text.

Input: In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation:

Output: T1133

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: ### Response: T1133.


Instruction: List the MITRE techniques contained in the text.

Input: Unit 42 Hildegard Malware)

Output: T1133

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit 42 Hildegard Malware) ### Response: T1133.


Instruction: List the MITRE techniques contained in the text.

Input: Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS.

Output: T1109

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. ### Response: T1109.


Instruction: List the MITRE techniques contained in the text.

Input: This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1019) but conducted upon other system components that may not have the same capability or level of integrity checking.

Output: T1109

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1019) but conducted upon other system components that may not have the same capability or level of integrity checking. ### Response: T1109.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious device firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.

Output: T1109

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious device firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks. ### Response: T1109.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft DART Case Report 001)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft DART Case Report 001) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation:

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Malware Persistence on OS X)(Citation: amnesia malware)

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malware Persistence on OS X)(Citation: amnesia malware) ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries.

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded.

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time.

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.(Citation: Writing Bad Malware for OSX)

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.(Citation: Writing Bad Malware for OSX) ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: There are tools available to perform these changes.

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are tools available to perform these changes. ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed.

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed. ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time.(Citation: Malware Persistence on OS X)

Output: T1546.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time.(Citation: Malware Persistence on OS X) ### Response: T1546.006.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

Output: T1539

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. ### Response: T1539.


Instruction: List the MITRE techniques contained in the text.

Input: Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Output: T1539

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. ### Response: T1539.


Instruction: List the MITRE techniques contained in the text.

Input: Cookies are often valid for an extended period of time, even if the web application is not actively used.

Output: T1539

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cookies are often valid for an extended period of time, even if the web application is not actively used. ### Response: T1539.


Instruction: List the MITRE techniques contained in the text.

Input: Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems.

Output: T1539

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. ### Response: T1539.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services).

Output: T1539

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). ### Response: T1539.


Instruction: List the MITRE techniques contained in the text.

Input: Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation:

Output: T1539

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: ### Response: T1539.


Instruction: List the MITRE techniques contained in the text.

Input: Pass The Cookie)

Output: T1539

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Pass The Cookie) ### Response: T1539.


Instruction: List the MITRE techniques contained in the text.

Input: There are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation:

Output: T1539

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: ### Response: T1539.


Instruction: List the MITRE techniques contained in the text.

Input: Unit 42 Mac Crypto Cookies January 2019)

Output: T1539

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit 42 Mac Crypto Cookies January 2019) ### Response: T1539.


Instruction: List the MITRE techniques contained in the text.

Input:
There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (ex: [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)) that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)

After an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to login to the corresponding web application.

Output: T1539

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (ex: [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)) that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)

After an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to login to the corresponding web application. ### Response: T1539.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments).

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation:

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: TechNet Task Scheduler Security)

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TechNet Task Scheduler Security) ### Response: T1053.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence.

Output: T1053

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence. ### Response: T1053.