Instruction: List the MITRE techniques contained in the text.

Input: Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Output: T1573.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4. ### Response: T1573.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Output: T1573

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. ### Response: T1573.


Instruction: List the MITRE techniques contained in the text.

Input: Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

Output: T1573

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files. ### Response: T1573.


Instruction: List the MITRE techniques contained in the text.

Input: Windows password filters are password policy enforcement mechanisms for both domain and local accounts.

Output: T1174

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows password filters are password policy enforcement mechanisms for both domain and local accounts. ### Response: T1174.


Instruction: List the MITRE techniques contained in the text.

Input: Filters are implemented as dynamic link libraries (DLLs) containing a method to validate potential passwords against password policies.

Output: T1174

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Filters are implemented as dynamic link libraries (DLLs) containing a method to validate potential passwords against password policies. ### Response: T1174.


Instruction: List the MITRE techniques contained in the text.

Input: Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts.

Output: T1174

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. ### Response: T1174.


Instruction: List the MITRE techniques contained in the text.

Input: Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter.

Output: T1174

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. ### Response: T1174.


Instruction: List the MITRE techniques contained in the text.

Input: Any potential changes cannot take effect until every registered filter acknowledges validation.

Output: T1174

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Any potential changes cannot take effect until every registered filter acknowledges validation. ### Response: T1174.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains.

Output: T1174

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. ### Response: T1174.


Instruction: List the MITRE techniques contained in the text.

Input: To perform proper validation, filters must receive plain-text credentials from the LSA.

Output: T1174

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: To perform proper validation, filters must receive plain-text credentials from the LSA. ### Response: T1174.


Instruction: List the MITRE techniques contained in the text.

Input: A malicious password filter would receive these plain-text credentials every time a password request is made.

Output: T1174

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A malicious password filter would receive these plain-text credentials every time a password request is made. ### Response: T1174.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Carnal Ownage Password Filters Sept 2013)

Output: T1174

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Carnal Ownage Password Filters Sept 2013) ### Response: T1174.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation:

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming)

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may achieve the same goal by modifying or extending features of the kernel.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may achieve the same goal by modifying or extending features of the kernel. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

Output: T1547

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges. ### Response: T1547.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse authentication packages to execute DLLs when the system boots.

Output: T1547.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse authentication packages to execute DLLs when the system boots. ### Response: T1547.002.


Instruction: List the MITRE techniques contained in the text.

Input: Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start.

Output: T1547.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. ### Response: T1547.002.


Instruction: List the MITRE techniques contained in the text.

Input: They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages)

Output: T1547.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) ### Response: T1547.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ with the key value of "Authentication Packages"=<target binary>.

Output: T1547.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ with the key value of "Authentication Packages"=<target binary>. ### Response: T1547.002.


Instruction: List the MITRE techniques contained in the text.

Input: The binary will then be executed by the system when the authentication packages are loaded.

Output: T1547.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The binary will then be executed by the system when the authentication packages are loaded. ### Response: T1547.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)

Output: T1218

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split) ### Response: T1218.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: The Regsvr32.exe binary may also be signed by Microsoft.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Regsvr32.exe binary may also be signed by Microsoft. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Microsoft Regsvr32)

Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Microsoft Regsvr32)

Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: This method makes no changes to the Registry as the COM object is not actually registered, only executed.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This method makes no changes to the Registry as the COM object is not actually registered, only executed. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: LOLBAS Regsvr32)

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: LOLBAS Regsvr32) ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments.

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments. ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input:
Targeting Mongolian Gov)

Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015).

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Targeting Mongolian Gov)

Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015). ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Carbon Black Squiblydoo Apr 2016)

Output: T1218.010

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Carbon Black Squiblydoo Apr 2016) ### Response: T1218.010.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Output: T1002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. ### Response: T1002.


Instruction: List the MITRE techniques contained in the text.

Input: The compression is done separately from the exfiltration channel and is performed using a custom program or algorithm, or a more common compression library or utility such as 7zip, RAR, ZIP, or zlib.

Output: T1002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The compression is done separately from the exfiltration channel and is performed using a custom program or algorithm, or a more common compression library or utility such as 7zip, RAR, ZIP, or zlib. ### Response: T1002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Firewall rules may also already exist to permit traffic to these services.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Firewall rules may also already exist to permit traffic to these services. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel.

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information.

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information. ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data.

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec)

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec) ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: **Note:**

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **Note:** ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs. ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search local file systems and remote file shares for files containing passwords.

Output: T1081

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search local file systems and remote file shares for files containing passwords. ### Response: T1081.


Instruction: List the MITRE techniques contained in the text.

Input: These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Output: T1081

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. ### Response: T1081.


Instruction: List the MITRE techniques contained in the text.

Input: It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).

Output: T1081

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). ### Response: T1081.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: CG 2014)

Output: T1081

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: CG 2014) ### Response: T1081.


Instruction: List the MITRE techniques contained in the text.

Input: Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.

Output: T1081

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. ### Response: T1081.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: SRD GPP)

Output: T1081

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: SRD GPP) ### Response: T1081.


Instruction: List the MITRE techniques contained in the text.

Input: In cloud environments, authenticated user credentials are often stored in local configuration and credential files.

Output: T1081

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In cloud environments, authenticated user credentials are often stored in local configuration and credential files. ### Response: T1081.


Instruction: List the MITRE techniques contained in the text.

Input: In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.

Output: T1081

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files. ### Response: T1081.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Specter Ops - Cloud Credential Storage)

Output: T1081

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Specter Ops - Cloud Credential Storage) ### Response: T1081.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's hosts that can be used during targeting.

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's hosts that can be used during targeting. ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.). ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation:

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: ATT ScanBox) Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: ATT ScanBox) Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).

Output: T1592

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)). ### Response: T1592.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather information about the victim's host software that can be used during targeting.

Output: T1592.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather information about the victim's host software that can be used during targeting. ### Response: T1592.002.


Instruction: List the MITRE techniques contained in the text.

Input: Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).

Output: T1592.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.). ### Response: T1592.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598).

Output: T1592.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). ### Response: T1592.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices).

Output: T1592.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). ### Response: T1592.002.


Instruction: List the MITRE techniques contained in the text.

Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or

Output: T1592.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or ### Response: T1592.002.


Instruction: List the MITRE techniques contained in the text.

Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or for initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).

Output: T1592.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or for initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)). ### Response: T1592.002.


Instruction: List the MITRE techniques contained in the text.

Input: Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Output: T1128

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. ### Response: T1128.


Instruction: List the MITRE techniques contained in the text.

Input: It contains functionality to add helper DLLs for extending functionality of the utility.

Output: T1128

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It contains functionality to add helper DLLs for extending functionality of the utility. ### Response: T1128.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: TechNet Netsh)

Output: T1128

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: TechNet Netsh) ### Response: T1128.


Instruction: List the MITRE techniques contained in the text.

Input: The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.

Output: T1128

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh. ### Response: T1128.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use netsh.exe with helper DLLs to proxy execution of arbitrary code in a persistent manner when netsh.exe is executed automatically with another Persistence technique or if other persistent software is present on the system that executes netsh.exe as part of its normal functionality.

Output: T1128

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use netsh.exe with helper DLLs to proxy execution of arbitrary code in a persistent manner when netsh.exe is executed automatically with another Persistence technique or if other persistent software is present on the system that executes netsh.exe as part of its normal functionality. ### Response: T1128.


Instruction: List the MITRE techniques contained in the text.

Input: Examples include some VPN software that invoke netsh.exe.

Output: T1128

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples include some VPN software that invoke netsh.exe. ### Response: T1128.


Instruction: List the MITRE techniques contained in the text.

Input:
(Citation: Demaske Netsh Persistence)

Proof of concept code exists to load Cobalt Strike's payload using netsh.exe helper DLLs.

Output: T1128

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Demaske Netsh Persistence)

Proof of concept code exists to load Cobalt Strike's payload using netsh.exe helper DLLs. ### Response: T1128.


Instruction: List the MITRE techniques contained in the text.

Input: (Citation: Github Netsh Helper CS Beacon)

Output: T1128

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: (Citation: Github Netsh Helper CS Beacon) ### Response: T1128.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may log user keystrokes to intercept credentials as the user types them.

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may log user keystrokes to intercept credentials as the user types them. ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Input: Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured.

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Input: In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.(Citation: Talos Kimsuky Nov 2021)

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.(Citation: Talos Kimsuky Nov 2021) ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Input: Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.(Citation: Adventures of a Keystroke)

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.(Citation: Adventures of a Keystroke) ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Input:
Some methods include:

*

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some methods include:

* ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Input: Hooking API callbacks used for processing keystrokes.

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hooking API callbacks used for processing keystrokes. ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Input: Unlike [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004), this focuses solely on API functions intended for processing keystroke data.

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unlike [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004), this focuses solely on API functions intended for processing keystroke data. ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Input: Reading raw keystroke data from the hardware buffer.

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Reading raw keystroke data from the hardware buffer. ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Input: * Windows Registry modifications.

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Windows Registry modifications. ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Input: * Custom drivers.

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * Custom drivers. ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Output: T1056.001


Instruction: List the MITRE techniques contained in the text.

Input: [Modify System Image](https://attack.mitre.org/techniques/T1601) may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device Attacks)

Output: T1056.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: [Modify System Image](https://attack.mitre.org/techniques/T1601) may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device Attacks) ### Response: T1056.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt.

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)). ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper)

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm Do You Trust Oct 2014)(Citation:

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: OSX Keydnap malware)(Citation: Spoofing credential dialogs)

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: OSX Keydnap malware)(Citation: Spoofing credential dialogs) ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: and [PowerShell](https://attack.mitre.org/techniques/T1059/001).(Citation: LogRhythm

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: and [PowerShell](https://attack.mitre.org/techniques/T1059/001).(Citation: LogRhythm ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: Do You Trust Oct 2014)(Citation:

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Do You Trust Oct 2014)(Citation: ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: Enigma Phishing for Credentials Jan 2015)(Citation:

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Enigma Phishing for Credentials Jan 2015)(Citation: ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: Spoofing credential dialogs)

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spoofing credential dialogs) ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. [Unix Shell](https://attack.mitre.org/techniques/T1059/004)).(Citation: Spoofing credential dialogs)

Output: T1056.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. [Unix Shell](https://attack.mitre.org/techniques/T1059/004)).(Citation: Spoofing credential dialogs) ### Response: T1056.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may hook into Windows application programming interface (API) functions to collect user credentials.

Output: T1056.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. ### Response: T1056.004.


Instruction: List the MITRE techniques contained in the text.

Input: Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017)

Output: T1056.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) ### Response: T1056.004.


Instruction: List the MITRE techniques contained in the text.

Input: Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001),  this technique focuses specifically on API functions that include parameters that reveal user credentials.

Output: T1056.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001),  this technique focuses specifically on API functions that include parameters that reveal user credentials. ### Response: T1056.004.


Instruction: List the MITRE techniques contained in the text.

Input: Hooking involves redirecting calls to these functions and can be implemented via:

Output: T1056.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Hooking involves redirecting calls to these functions and can be implemented via: ### Response: T1056.004.


Instruction: List the MITRE techniques contained in the text.

Input: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.(Citation: Microsoft Hook Overview)(Citation: Elastic Process Injection July 2017)

Output: T1056.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.(Citation: Microsoft Hook Overview)(Citation: Elastic Process Injection July 2017) ### Response: T1056.004.


Instruction: List the MITRE techniques contained in the text.

Input: * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.(Citation: Elastic Process Injection July 2017)(Citation: Adlice Software IAT Hooks Oct 2014)(Citation:

Output: T1056.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.(Citation: Elastic Process Injection July 2017)(Citation: Adlice Software IAT Hooks Oct 2014)(Citation: ### Response: T1056.004.


Instruction: List the MITRE techniques contained in the text.

Input: MWRInfoSecurity Dynamic Hooking 2015)

Output: T1056.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: MWRInfoSecurity Dynamic Hooking 2015) ### Response: T1056.004.


Instruction: List the MITRE techniques contained in the text.

Input: * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.(Citation: Elastic Process Injection July 2017)(Citation:

Output: T1056.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: * **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.(Citation: Elastic Process Injection July 2017)(Citation: ### Response: T1056.004.


Instruction: List the MITRE techniques contained in the text.

Input: HighTech Bridge Inline Hooking Sept 2011)(Citation: MWRInfoSecurity Dynamic Hooking 2015)

Output: T1056.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: HighTech Bridge Inline Hooking Sept 2011)(Citation: MWRInfoSecurity Dynamic Hooking 2015) ### Response: T1056.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service.

Output: T1056.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. ### Response: T1056.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, a compromised login page may log provided user credentials before logging the user in to the service.

Output: T1056.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, a compromised login page may log provided user credentials before logging the user in to the service. ### Response: T1056.003.


Instruction: List the MITRE techniques contained in the text.

Input: This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)

Output: T1056.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging) ### Response: T1056.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use methods of capturing user input to obtain credentials or collect information.

Output: T1056

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use methods of capturing user input to obtain credentials or collect information. ### Response: T1056.


Instruction: List the MITRE techniques contained in the text.

Input: During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes.

Output: T1056

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. ### Response: T1056.


Instruction: List the MITRE techniques contained in the text.

Input: Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).

Output: T1056

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)). ### Response: T1056.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send phishing messages to gain access to victim systems.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send phishing messages to gain access to victim systems. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of phishing are electronically delivered social engineering.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of phishing are electronically delivered social engineering. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing can be targeted, known as spearphishing.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing can be targeted, known as spearphishing. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing may also be conducted via third-party services, like social media platforms.

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing may also be conducted via third-party services, like social media platforms. ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Palo Alto Unit 42 VBA Infostealer 2014)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Palo Alto Unit 42 VBA Infostealer 2014) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation:

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Unit42 Luna Moth)

Output: T1566

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Unit42 Luna Moth) ### Response: T1566.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use voice communications to ultimately gain access to victim systems.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use voice communications to ultimately gain access to victim systems. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing voice is a specific variant of spearphishing.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing voice is a specific variant of spearphishing. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: It is different from other forms of spearphishing in that is employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: It is different from other forms of spearphishing in that is employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: [Impersonation](https://attack.mitre.org/techniques/T1656))

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: and/or creating a sense of urgency or alarm for the recipient.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: and/or creating a sense of urgency or alarm for the recipient. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: All forms of phishing are electronically delivered social engineering.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All forms of phishing are electronically delivered social engineering. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: In this scenario, adversaries are not directly sending malware to a victim vice relying on [User Execution](https://attack.mitre.org/techniques/T1204) for delivery and execution.

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In this scenario, adversaries are not directly sending malware to a victim vice relying on [User Execution](https://attack.mitre.org/techniques/T1204) for delivery and execution. ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation:

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools ([Remote Access Software](https://attack.mitre.org/techniques/T1219))

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools ([Remote Access Software](https://attack.mitre.org/techniques/T1219)) ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input:
onto their computer.(Citation: Unit42 Luna Moth)

Adversaries may also combine voice phishing with [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621) in order to trick users into divulging MFA credentials or accepting authentication prompts.(Citation: Proofpoint Vishing)

Output: T1566.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: onto their computer.(Citation: Unit42 Luna Moth)

Adversaries may also combine voice phishing with [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621) in order to trick users into divulging MFA credentials or accepting authentication prompts.(Citation: Proofpoint Vishing) ### Response: T1566.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may build capabilities that can be used during targeting.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may build capabilities that can be used during targeting. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT1)(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT1)(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation:

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Talos Promethium June 2020)

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Talos Promethium June 2020) ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: As with legitimate development efforts, different skill sets may be required for developing capabilities.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As with legitimate development efforts, different skill sets may be required for developing capabilities. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: The skills needed may be located in-house, or may need to be contracted out.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The skills needed may be located in-house, or may need to be contracted out. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.

Output: T1587

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability. ### Response: T1587.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may develop exploits that can be used during targeting.

Output: T1587.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may develop exploits that can be used during targeting. ### Response: T1587.004.


Instruction: List the MITRE techniques contained in the text.

Input: An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software.

Output: T1587.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. ### Response: T1587.004.


Instruction: List the MITRE techniques contained in the text.

Input: Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.(Citation: NYTStuxnet)

Output: T1587.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.(Citation: NYTStuxnet) ### Response: T1587.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use information acquired via [Vulnerabilities](https://attack.mitre.org/techniques/T1588/006) to focus exploit development efforts.

Output: T1587.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use information acquired via [Vulnerabilities](https://attack.mitre.org/techniques/T1588/006) to focus exploit development efforts. ### Response: T1587.004.


Instruction: List the MITRE techniques contained in the text.

Input: As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.(Citation:

Output: T1587.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.(Citation: ### Response: T1587.004.


Instruction: List the MITRE techniques contained in the text.

Input: Irongeek Sims BSides 2017)

Output: T1587.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Irongeek Sims BSides 2017) ### Response: T1587.004.