Instruction: List the MITRE techniques contained in the text.

Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

Output: T1546

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. ### Response: T1546.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: In practice this is nearly every program, since user32.dll is a very common library.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In practice this is nearly every program, since user32.dll is a very common library. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Elastic Process Injection July 2017)

Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Elastic Process Injection July 2017)

Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AppInit Registry)

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AppInit Registry) ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: AppInit Secure Boot)

Output: T1546.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: AppInit Secure Boot) ### Response: T1546.010.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use voice communications to elicit sensitive information that can be used during targeting.

Output: T1598.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. ### Response: T1598.004.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Output: T1598.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. ### Response: T1598.004.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient.

Output: T1598.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient. ### Response: T1598.004.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of phishing are electronically delivered social engineering.

Output: T1598.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of phishing are electronically delivered social engineering. ### Response: T1598.004.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, adversaries use phone calls to elicit sensitive information from victims.

Output: T1598.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, adversaries use phone calls to elicit sensitive information from victims. ### Response: T1598.004.


Instruction: List the MITRE techniques contained in the text.

Input: Known as voice phishing (or "vishing"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls.

Output: T1598.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Known as voice phishing (or "vishing"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. ### Response: T1598.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff.(Citation: BOA Telephone Scams)

Victims may also receive phishing messages that direct them to call a phone number ("callback phishing") where the adversary attempts to collect confidential information.(Citation: Avertium callback phishing)

Output: T1598.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff.(Citation: BOA Telephone Scams)

Victims may also receive phishing messages that direct them to call a phone number ("callback phishing") where the adversary attempts to collect confidential information.(Citation: Avertium callback phishing) ### Response: T1598.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1598.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1598.004.


Instruction: List the MITRE techniques contained in the text.

Input: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to tailor pretexts to be even more persuasive and believable for the victim.

Output: T1598.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to tailor pretexts to be even more persuasive and believable for the victim. ### Response: T1598.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting.

Output: T1598.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. ### Response: T1598.001.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Output: T1598.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. ### Response: T1598.001.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

Output: T1598.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. ### Response: T1598.001.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1598.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1598.001.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services.(Citation: ThreatPost Social Media Phishing)

Output: T1598.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services.(Citation: ThreatPost Social Media Phishing) ### Response: T1598.001.


Instruction: List the MITRE techniques contained in the text.

Input: These services are more likely to have a less-strict security policy than an enterprise.

Output: T1598.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These services are more likely to have a less-strict security policy than an enterprise. ### Response: T1598.001.


Instruction: List the MITRE techniques contained in the text.

Input: As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way.

Output: T1598.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. ### Response: T1598.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create fake social media accounts and message employees for potential job opportunities.

Output: T1598.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create fake social media accounts and message employees for potential job opportunities. ### Response: T1598.001.


Instruction: List the MITRE techniques contained in the text.

Input: Doing so allows a plausible reason for asking about services, policies, and information about their environment.

Output: T1598.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Doing so allows a plausible reason for asking about services, policies, and information about their environment. ### Response: T1598.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.

Output: T1598.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures. ### Response: T1598.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, adversaries attach a file to the spearphishing email and usually rely upon the recipient populating information then returning the file.(Citation: Sophos Attachment)(Citation: GitHub Phishery)

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, adversaries attach a file to the spearphishing email and usually rely upon the recipient populating information then returning the file.(Citation: Sophos Attachment)(Citation: GitHub Phishery) ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.

Output: T1598.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures. ### Response: T1598.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin)

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin) ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023)

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023) ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also link to "web bugs" or "web beacons" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address.(Citation: NIST Web Bug)

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also link to "web bugs" or "web beacons" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address.(Citation: NIST Web Bug) ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also be able to spoof a complete website using what is known as a "browser-in-the-browser" (BitB) attack.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also be able to spoof a complete website using what is known as a "browser-in-the-browser" (BitB) attack. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods.(Citation: ZScaler BitB 2020)(Citation:

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods.(Citation: ZScaler BitB 2020)(Citation: ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Mr. D0x BitB 2022)

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mr. D0x BitB 2022) ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to proxy the connection between the victim and the legitimate website.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to proxy the connection between the victim and the legitimate website. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539))

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)) ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: in addition to their username and password.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: in addition to their username and password. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input:
This may enable the adversary to then bypass MFA via [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004).(Citation: Proofpoint Human Factor)

From the fake website, information is gathered in web forms and sent to the adversary.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This may enable the adversary to then bypass MFA via [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004).(Citation: Proofpoint Human Factor)

From the fake website, information is gathered in web forms and sent to the adversary. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.

Output: T1598.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures. ### Response: T1598.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of phishing are electronically delivered social engineering.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of phishing are electronically delivered social engineering. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing can be targeted, known as spearphishing.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing can be targeted, known as spearphishing. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation:

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation: ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation:

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation: ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input:
Sophos Attachment)(Citation: GitHub Phishery) Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information.(Citation: Avertium callback phishing)

Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Sophos Attachment)(Citation: GitHub Phishery) Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information.(Citation: Avertium callback phishing)

Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input:
Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce)

Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation:

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce)

Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Palo Alto Unit 42 VBA Infostealer 2014)

Output: T1598

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Palo Alto Unit 42 VBA Infostealer 2014) ### Response: T1598.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Output: T1496

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. ### Response: T1496.


Instruction: List the MITRE techniques contained in the text.

Input: One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency.

Output: T1496

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. ### Response: T1496.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation:

Output: T1496

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: ### Response: T1496.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.(Citation: CloudSploit - Unused AWS Regions) Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs)

Output: T1496

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.(Citation: CloudSploit - Unused AWS Regions) Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs) ### Response: T1496.


Instruction: List the MITRE techniques contained in the text.

Input: Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners)

Output: T1496

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners) ### Response: T1496.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR)

Output: T1496

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR) ### Response: T1496.


Instruction: List the MITRE techniques contained in the text.

Input: Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.(Citation: Sysdig Proxyjacking)

Output: T1496

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.(Citation: Sysdig Proxyjacking) ### Response: T1496.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create accounts with cloud providers that can be used during targeting.

Output: T1585.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create accounts with cloud providers that can be used during targeting. ### Response: T1585.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s.

Output: T1585.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. ### Response: T1585.003.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure.

Output: T1585.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. ### Response: T1585.003.


Instruction: List the MITRE techniques contained in the text.

Input: Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)

Output: T1585.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud) ### Response: T1585.003.


Instruction: List the MITRE techniques contained in the text.

Input: Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider.

Output: T1585.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider. ### Response: T1585.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create email accounts that can be used during targeting.

Output: T1585.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create email accounts that can be used during targeting. ### Response: T1585.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation:

Output: T1585.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: ### Response: T1585.002.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT1) Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors.

Output: T1585.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT1) Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. ### Response: T1585.002.


Instruction: List the MITRE techniques contained in the text.

Input: Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1)

Output: T1585.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1) ### Response: T1585.002.


Instruction: List the MITRE techniques contained in the text.

Input: To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016)

Output: T1585.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016) ### Response: T1585.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create and cultivate social media accounts that can be used during targeting.

Output: T1585.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create and cultivate social media accounts that can be used during targeting. ### Response: T1585.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can create social media accounts that can be used to build a persona to further operations.

Output: T1585.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can create social media accounts that can be used to build a persona to further operations. ### Response: T1585.001.


Instruction: List the MITRE techniques contained in the text.

Input: Persona development consists of the development of public information, presence, history and appropriate affiliations.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

Output: T1585.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Persona development consists of the development of public information, presence, history and appropriate affiliations.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) ### Response: T1585.001.


Instruction: List the MITRE techniques contained in the text.

Input: For operations incorporating social engineering, the utilization of a persona on social media may be important.

Output: T1585.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For operations incorporating social engineering, the utilization of a persona on social media may be important. ### Response: T1585.001.


Instruction: List the MITRE techniques contained in the text.

Input: These personas may be fictitious or impersonate real people.

Output: T1585.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These personas may be fictitious or impersonate real people. ### Response: T1585.001.


Instruction: List the MITRE techniques contained in the text.

Input: The persona may exist on a single social media site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.).

Output: T1585.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The persona may exist on a single social media site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). ### Response: T1585.001.


Instruction: List the MITRE techniques contained in the text.

Input: Establishing a persona  on social media may require development of additional documentation to make them seem real.

Output: T1585.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Establishing a persona  on social media may require development of additional documentation to make them seem real. ### Response: T1585.001.


Instruction: List the MITRE techniques contained in the text.

Input: This could include filling out profile information, developing social networks, or incorporating photos.

Output: T1585.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This could include filling out profile information, developing social networks, or incorporating photos. ### Response: T1585.001.


Instruction: List the MITRE techniques contained in the text.

Input: Once a persona has been developed an adversary can use it to create connections to targets of interest.

Output: T1585.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once a persona has been developed an adversary can use it to create connections to targets of interest. ### Response: T1585.001.


Instruction: List the MITRE techniques contained in the text.

Input: These connections may be direct or may include trying to connect through others.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

Output: T1585.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These connections may be direct or may include trying to connect through others.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) ### Response: T1585.001.


Instruction: List the MITRE techniques contained in the text.

Input: These accounts may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).

Output: T1585.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These accounts may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)). ### Response: T1585.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may create and cultivate accounts with services that can be used during targeting.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may create and cultivate accounts with services that can be used during targeting. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can create accounts that can be used to build a persona to further operations.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can create accounts that can be used to build a persona to further operations. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: Persona development consists of the development of public information, presence, history and appropriate affiliations.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Persona development consists of the development of public information, presence, history and appropriate affiliations. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: For operations incorporating social engineering, the utilization of an online persona may be important.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For operations incorporating social engineering, the utilization of an online persona may be important. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: These personas may be fictitious or impersonate real people.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These personas may be fictitious or impersonate real people. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.).

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: Establishing a persona may require development of additional documentation to make them seem real.

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Establishing a persona may require development of additional documentation to make them seem real. ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input:
This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1)

Output: T1585

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)

Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) ### Response: T1585.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire information about vulnerabilities that can be used during targeting.

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire information about vulnerabilities that can be used during targeting. ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur.

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database)

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database) ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities.

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities. ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: There is usually a delay between when a vulnerability is discovered and when it is made public.

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There is usually a delay between when a vulnerability is discovered and when it is made public. ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors).

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors). ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. [Exploits](https://attack.mitre.org/techniques/T1588/005)) or to attempt to develop one themselves (i.e. [Exploits](https://attack.mitre.org/techniques/T1587/004)).

Output: T1588.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. [Exploits](https://attack.mitre.org/techniques/T1588/005)) or to attempt to develop one themselves (i.e. [Exploits](https://attack.mitre.org/techniques/T1587/004)). ### Response: T1588.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy, steal, or download exploits that can be used during targeting.

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy, steal, or download exploits that can be used during targeting. ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software.

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.(Citation: Exploit Database)(Citation: TempertonDarkHotel)(Citation: NationsBuying)

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.(Citation: Exploit Database)(Citation: TempertonDarkHotel)(Citation: NationsBuying) ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to downloading free exploits from the internet, adversaries may purchase exploits from third-party entities.

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to downloading free exploits from the internet, adversaries may purchase exploits from third-party entities. ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: Third-party entities can include technology companies that specialize in exploit development, criminal marketplaces (including exploit kits), or from individuals.(Citation: PegasusCitizenLab)(Citation:

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Third-party entities can include technology companies that specialize in exploit development, criminal marketplaces (including exploit kits), or from individuals.(Citation: PegasusCitizenLab)(Citation: ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: Wired SandCat Oct 2019)

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Wired SandCat Oct 2019) ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to purchasing exploits, adversaries may steal and repurpose exploits from third-party entities (including other adversaries).(Citation: TempertonDarkHotel)

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to purchasing exploits, adversaries may steal and repurpose exploits from third-party entities (including other adversaries).(Citation: TempertonDarkHotel) ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits.

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits. ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: There is usually a delay between when an exploit is discovered and when it is made public.

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There is usually a delay between when an exploit is discovered and when it is made public. ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may target the systems of those known to conduct exploit research and development in order to gain that knowledge for use during a subsequent operation.

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may target the systems of those known to conduct exploit research and development in order to gain that knowledge for use during a subsequent operation. ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190),

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068),

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).

Output: T1588.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)). ### Response: T1588.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: SSL/TLS certificates are designed to instill trust.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SSL/TLS certificates are designed to instill trust. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)).

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise)

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise) ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ)

After obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.

Output: T1588.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ)

After obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control. ### Response: T1588.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy, steal, or download software tools that can be used during targeting.

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy, steal, or download software tools that can be used during targeting. ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: Tools can be open or closed source, free or commercial.

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Tools can be open or closed source, free or commercial. ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)).

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154).

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154). ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.(Citation: Recorded Future Beacon 2019)

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.(Citation: Recorded Future Beacon 2019) ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors.

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries).

Output: T1588.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). ### Response: T1588.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy and/or steal code signing certificates that can be used during targeting.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy and/or steal code signing certificates that can be used during targeting. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may purchase or steal code signing certificates for use in operations.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may purchase or steal code signing certificates for use in operations. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also steal code signing materials directly from a compromised third-party.

Output: T1588.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also steal code signing materials directly from a compromised third-party. ### Response: T1588.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy, steal, or download malware that can be used during targeting.

Output: T1588.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy, steal, or download malware that can be used during targeting. ### Response: T1588.001.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols.

Output: T1588.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. ### Response: T1588.001.