Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003).

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos is an authentication protocol widely used in modern Windows domain environments.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos is an authentication protocol widely used in modern Windows domain environments. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The KDC is responsible for both authentication and ticket granting.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The KDC is responsible for both authentication and ticket granting. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input:
On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)

Linux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the "ccache".

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)

Linux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the "ccache". ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.(Citation: MIT ccache)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.(Citation: MIT ccache) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Both files require root access to read.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both files require root access to read. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003).

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The ccache file may also be converted into a Windows format using tools such as Kekeo.(Citation:

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The ccache file may also be converted into a Windows format using tools such as Kekeo.(Citation: ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Kerberos tickets on macOS are stored in a standard ccache format, similar to Linux.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Kerberos tickets on macOS are stored in a standard ccache format, similar to Linux. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework.

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework. ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.(Citation:

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.(Citation: ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: SpectorOps Bifrost Kerberos macOS 2019)(Citation: macOS kerberos framework MIT)

Output: T1558

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: SpectorOps Bifrost Kerberos macOS 2019)(Citation: macOS kerberos framework MIT) ### Response: T1558.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire credentials from the Windows Credential Manager.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire credentials from the Windows Credential Manager. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker) ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: The Windows Credential Manager separates website credentials from application or network credentials in two lockers.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Windows Credential Manager separates website credentials from application or network credentials in two lockers. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Application and network credentials are stored in the Windows Credentials locker.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Application and network credentials are stored in the Windows Credentials locker. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\`.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\`. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation:

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Malwarebytes The Windows Vault)

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Malwarebytes The Windows Vault) ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager.(Citation:

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager.(Citation: ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager) ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also obtain credentials from credential backups.

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also obtain credentials from credential backups. ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI.

Password recovery tools may also obtain plain text passwords from the Credential Manager.(Citation:

Output: T1555.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI.

Password recovery tools may also obtain plain text passwords from the Credential Manager.(Citation: ### Response: T1555.004.


Instruction: List the MITRE techniques contained in the text.

Input: Malwarebytes The Windows Vault)

Output: T1555.004


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire credentials from Keychain.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire credentials from Keychain. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: The default Keychain is the Login Keychain, which stores user passwords and information.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The default Keychain is the Login Keychain, which stores user passwords and information. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: The System Keychain stores items accessed by the operating system, such as items shared among users on a host.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The System Keychain stores items accessed by the operating system, such as items shared among users on a host. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann)

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann) ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may gather user credentials from Keychain storage/memory.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may gather user credentials from Keychain storage/memory. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: For example, the command security dump-keychain –d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, the command security dump-keychain –d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also directly read Login Keychain credentials from the <code>~/Library/Keychains/login.keychain</code> file.

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also directly read Login Keychain credentials from the <code>~/Library/Keychains/login.keychain</code> file. ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt)

Output: T1555.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt) ### Response: T1555.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019)

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Password managers are applications designed to store user credentials, normally in an encrypted database.

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Password managers are applications designed to store user credentials, normally in an encrypted database. ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Credentials are typically accessible after a user provides a master password that unlocks the database.

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Credentials are typically accessible after a user provides a master password that unlocks the database. ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: After the database is unlocked, these credentials may be copied to memory.

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: After the database is unlocked, these credentials may be copied to memory. ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: These databases can be stored as files on disk.(Citation: ise Password Manager February 2019)

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These databases can be stored as files on disk.(Citation: ise Password Manager February 2019) ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief)

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief) ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may extract credentials from memory via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212).(Citation:

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may extract credentials from memory via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212).(Citation: ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: NVD CVE-2019-3610)

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: NVD CVE-2019-3610) ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also try brute forcing via [Password Guessing](https://attack.mitre.org/techniques/T1110/001) to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019)

Output: T1555.005

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also try brute forcing via [Password Guessing](https://attack.mitre.org/techniques/T1110/001) to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019) ### Response: T1555.005.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.

Output: T1555.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault. ### Response: T1555.006.


Instruction: List the MITRE techniques contained in the text.

Input: Secrets managers support the secure centralized management of passwords, API keys, and other credential material.

Output: T1555.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Secrets managers support the secure centralized management of passwords, API keys, and other credential material. ### Response: T1555.006.


Instruction: List the MITRE techniques contained in the text.

Input: Where secrets managers are in use, cloud services can dynamically acquire credentials via API requests rather than accessing secrets insecurely stored in plain text files or environment variables.

Output: T1555.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Where secrets managers are in use, cloud services can dynamically acquire credentials via API requests rather than accessing secrets insecurely stored in plain text files or environment variables. ### Response: T1555.006.


Instruction: List the MITRE techniques contained in the text.

Input: If an adversary is able to gain sufficient privileges in a cloud environment – for example, by obtaining the credentials of high-privileged [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004) or compromising a service that has permission to retrieve secrets – they may be able to request secrets from the secrets manager.

Output: T1555.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: If an adversary is able to gain sufficient privileges in a cloud environment – for example, by obtaining the credentials of high-privileged [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004) or compromising a service that has permission to retrieve secrets – they may be able to request secrets from the secrets manager. ### Response: T1555.006.


Instruction: List the MITRE techniques contained in the text.

Input: This can be accomplished via commands such as `get-secret-value` in AWS, `gcloud secrets describe` in GCP, and `az key vault secret show` in Azure.(Citation: Permiso Scattered Spider 2023)(Citation: Sysdig ScarletEel 2.0 2023)(Citation:

Output: T1555.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can be accomplished via commands such as `get-secret-value` in AWS, `gcloud secrets describe` in GCP, and `az key vault secret show` in Azure.(Citation: Permiso Scattered Spider 2023)(Citation: Sysdig ScarletEel 2.0 2023)(Citation: ### Response: T1555.006.


Instruction: List the MITRE techniques contained in the text.

Input: AWS

Output: T1555.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: AWS ### Response: T1555.006.


Instruction: List the MITRE techniques contained in the text.

Input: Secrets Manager)(Citation: Google Cloud Secrets)(Citation:

Output: T1555.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Secrets Manager)(Citation: Google Cloud Secrets)(Citation: ### Response: T1555.006.


Instruction: List the MITRE techniques contained in the text.

Input:
Microsoft Azure Key Vault)

**Note:** this technique is distinct from [Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005) in that the credentials are being directly requested from the cloud secrets manager, rather than through the medium of the instance metadata API.

Output: T1555.006

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Microsoft Azure Key Vault)

**Note:** this technique is distinct from [Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005) in that the credentials are being directly requested from the cloud secrets manager, rather than through the medium of the instance metadata API. ### Response: T1555.006.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation:

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;.

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key.(Citation: Microsoft CryptUnprotectData April 2018)

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key.(Citation: Microsoft CryptUnprotectData April 2018) ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017)

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the [Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004).

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the [Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004). ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input:
Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)

After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access.

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)

After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).

Output: T1555.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator). ### Response: T1555.003.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain.

Output: T1555.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain. ### Response: T1555.002.


Instruction: List the MITRE techniques contained in the text.

Input: This provides the adversary with all the plaintext passwords for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware)

Output: T1555.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This provides the adversary with all the plaintext passwords for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware) ### Response: T1555.002.


Instruction: List the MITRE techniques contained in the text.

Input: In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way)

Output: T1555.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way) ### Response: T1555.002.


Instruction: List the MITRE techniques contained in the text.

Input: Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory.

Output: T1555.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. ### Response: T1555.002.


Instruction: List the MITRE techniques contained in the text.

Input: Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain)

Output: T1555.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain) ### Response: T1555.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may search for common password storage locations to obtain user credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may search for common password storage locations to obtain user credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Output: T1555

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information. ### Response: T1555.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel.

Output: T1567.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. ### Response: T1567.001.


Instruction: List the MITRE techniques contained in the text.

Input: Code repositories are often accessible via an API (ex: https://api.github.com).

Output: T1567.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Code repositories are often accessible via an API (ex: https://api.github.com). ### Response: T1567.001.


Instruction: List the MITRE techniques contained in the text.

Input: Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.

Output: T1567.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. ### Response: T1567.001.


Instruction: List the MITRE techniques contained in the text.

Input: Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.

Output: T1567.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network. ### Response: T1567.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel.

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information.

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information. ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data.

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec)

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec) ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: **Note:**

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: **Note:** ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.

Output: T1567.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs. ### Response: T1567.003.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.

Output: T1567.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. ### Response: T1567.002.


Instruction: List the MITRE techniques contained in the text.

Input: Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Output: T1567.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. ### Response: T1567.002.


Instruction: List the MITRE techniques contained in the text.

Input: Examples of cloud storage services include Dropbox and Google Docs.

Output: T1567.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Examples of cloud storage services include Dropbox and Google Docs. ### Response: T1567.002.


Instruction: List the MITRE techniques contained in the text.

Input: Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.

Output: T1567.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service. ### Response: T1567.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel.

Output: T1567.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. ### Response: T1567.004.


Instruction: List the MITRE techniques contained in the text.

Input: Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation:

Output: T1567.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: ### Response: T1567.004.


Instruction: List the MITRE techniques contained in the text.

Input: Discord Intro to Webhooks)

Output: T1567.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Discord Intro to Webhooks) ### Response: T1567.004.


Instruction: List the MITRE techniques contained in the text.

Input: When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application.

Output: T1567.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. ### Response: T1567.004.


Instruction: List the MITRE techniques contained in the text.

Input:
Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server)

Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection.

Output: T1567.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server)

Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. ### Response: T1567.004.


Instruction: List the MITRE techniques contained in the text.

Input: Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation:

Output: T1567.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: ### Response: T1567.004.


Instruction: List the MITRE techniques contained in the text.

Input: Checkmarx Webhooks)

Output: T1567.004

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Checkmarx Webhooks) ### Response: T1567.004.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Firewall rules may also already exist to permit traffic to these services.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Firewall rules may also already exist to permit traffic to these services. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Output: T1567

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection. ### Response: T1567.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks.

Output: T1219

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. ### Response: T1219.


Instruction: List the MITRE techniques contained in the text.

Input: These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)

Output: T1219

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) ### Response: T1219.


Instruction: List the MITRE techniques contained in the text.

Input: Remote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system.

Output: T1219

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Remote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. ### Response: T1219.


Instruction: List the MITRE techniques contained in the text.

Input: They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.

Output: T1219

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system. ### Response: T1219.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Output: T1219

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. ### Response: T1219.


Instruction: List the MITRE techniques contained in the text.

Input: Installation of many remote access software may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)).

Output: T1219

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Installation of many remote access software may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). ### Response: T1219.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may buy, lease, or rent infrastructure that can be used during targeting.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may buy, lease, or rent infrastructure that can be used during targeting. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: A wide variety of infrastructure exists for hosting and orchestrating adversary operations.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A wide variety of infrastructure exists for hosting and orchestrating adversary operations. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation:

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Mandiant APT29 Microsoft 365 2022)

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Mandiant APT29 Microsoft 365 2022) ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.

Output: T1583

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down. ### Response: T1583.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may acquire domains that can be used during targeting.

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may acquire domains that can be used during targeting. ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Domain names are the human readable names used to represent one or more IP addresses.

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domain names are the human readable names used to represent one or more IP addresses. ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: They can be purchased or, in some cases, acquired for free.

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: They can be purchased or, in some cases, acquired for free. ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020)

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam)

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing)

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing) ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering)

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering) ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain.

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain.

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain.

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.(Citation: Mandiant APT1)

Output: T1583.001

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.(Citation: Mandiant APT1) ### Response: T1583.001.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may compress and/or encrypt data that is collected prior to exfiltration.

Output: T1560

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may compress and/or encrypt data that is collected prior to exfiltration. ### Response: T1560.


Instruction: List the MITRE techniques contained in the text.

Input: Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.

Output: T1560

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. ### Response: T1560.


Instruction: List the MITRE techniques contained in the text.

Input: Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

Output: T1560

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. ### Response: T1560.


Instruction: List the MITRE techniques contained in the text.

Input: Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

Output: T1560

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method. ### Response: T1560.


Instruction: List the MITRE techniques contained in the text.

Input: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries.

Output: T1560.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. ### Response: T1560.002.


Instruction: List the MITRE techniques contained in the text.

Input: Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github).

Output: T1560.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). ### Response: T1560.002.


Instruction: List the MITRE techniques contained in the text.

Input: Most libraries include functionality to encrypt and/or compress data.

Output: T1560.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Most libraries include functionality to encrypt and/or compress data. ### Response: T1560.002.


Instruction: List the MITRE techniques contained in the text.

Input: Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows.

Output: T1560.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. ### Response: T1560.002.


Instruction: List the MITRE techniques contained in the text.

Input: Note that the libraries are different from the utilities.

Output: T1560.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Note that the libraries are different from the utilities. ### Response: T1560.002.


Instruction: List the MITRE techniques contained in the text.

Input: The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.

Output: T1560.002

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism. ### Response: T1560.002.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Process injection is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Process injection is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: These implementations exist for every major OS but are typically platform specific.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: These implementations exist for every major OS but are typically platform specific. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Output: T1055

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ### Response: T1055.


Instruction: List the MITRE techniques contained in the text.

Input: Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

Output: T1055.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ### Response: T1055.003.


Instruction: List the MITRE techniques contained in the text.

Input: Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process.

Output: T1055.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process. ### Response: T1055.003.


Instruction: List the MITRE techniques contained in the text.

Input: Thread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced with malicious code or the path to a DLL.

Output: T1055.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Thread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced with malicious code or the path to a DLL. ### Response: T1055.003.


Instruction: List the MITRE techniques contained in the text.

Input: A handle to an existing victim process is first created with native Windows API calls such as OpenThread.

Output: T1055.003

Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: A handle to an existing victim process is first created with native Windows API calls such as OpenThread. ### Response: T1055.003.