Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique TCC Manipulation (T1548.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Domains (T1584.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account, taking advantage of renewal process gaps, or compromising a cloud service that enables managing domains (e.g., AWS Route53).(Citation: Krebs DNS Hijack 2019)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Peripheral Device Discovery (T1120). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique ListPlanting (T1055.015). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process.(Citation: Hexacorn Listplanting) Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.


Instruction: What is the purpose of the ATT&CK technique Domain Fronting (T1172)?

Input:
Linux
macOS
Windows

Output: Domain fronting takes advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) The technique involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Escape to Host (T1611). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
Containers
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Security Software Discovery (T1063). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1063) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Dylib Hijacking (T1574.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with @rpath, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable.  Additionally, if weak linking is used, such as the LC_LOAD_WEAK_DYLIB function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added.


Instruction: What is the purpose of the ATT&CK technique Remote Desktop Protocol (T1076)?

Input: Windows

Output: Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). (Citation: TechNet Remote Desktop Services) There are other implementations and third-party tools that provide graphical access [Remote Services](https://attack.mitre.org/techniques/T1021) similar to RDS.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Web Services (T1583.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: FireEye APT29)(Citation: Hacker News GitHub Abuse 2024) By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.


Instruction: What is the purpose of the ATT&CK technique Compromise Infrastructure (T1584)?

Input: PRE

Output: Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.


Instruction: What is the purpose of the ATT&CK technique SQL Stored Procedures (T1505.001)?

Input:
Windows
Linux

Output: Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Client Configurations (T1592.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone.


Instruction: What is the purpose of the ATT&CK technique Downgrade System Image (T1601.002)?

Input: Network Devices

Output: Adversaries may install an older version of the operating system of a network device to weaken security.  Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. (Citation: Cisco Synful Knock Evolution)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Environmental Keying (T1480.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of [Execution Guardrails](https://attack.mitre.org/techniques/T1480) that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.(Citation: EK Clueless Agents)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Office Template Macros (T1137.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Hooking (T1179). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Upload Tool (T1608.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Remote Data Staging (T1074.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Network Device CLI (T1059.008). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands.


Instruction: What is the purpose of the ATT&CK technique Non-Standard Port (T1571)?

Input:
Linux
macOS
Windows
ESXi

Output: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.


Instruction: What is the purpose of the ATT&CK technique Data Encrypted (T1022)?

Input:
Linux
macOS
Windows

Output: Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.


Instruction: What is the purpose of the ATT&CK technique Debugger Evasion (T1622)?

Input:
Windows
Linux
macOS

Output: Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.(Citation: ProcessHacker Github)


Instruction: What is the purpose of the ATT&CK technique Establish Accounts (T1585)?

Input: PRE

Output: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Cloud Secrets Management Stores (T1555.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Startup Items (T1037.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Unsecured Credentials (T1552). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
SaaS
IaaS
Linux
macOS
Containers
Network Devices
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)),  or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Template Injection (T1221). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.(Citation: Microsoft Open XML July 2017)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique System Information Discovery (T1082). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Scripting (T1064). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
**This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.**


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Regsvr32 (T1117). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe can be used to execute arbitrary binaries. (Citation: Microsoft Regsvr32)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Email Accounts (T1585.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Revert Cloud Instance (T1578.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Remote Access Tools (T1219). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique DNS Server (T1584.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Windows Command Shell (T1059.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: SSH in Windows)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Spearphishing via Service (T1194). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Windows File and Directory Permissions Modification (T1222.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).


Instruction: What is the purpose of the ATT&CK technique Kernel Modules and Extensions (T1215)?

Input:
Linux
macOS

Output: Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) When used maliciously, Loadable Kernel Modules (LKMs) can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Adversaries can use loadable kernel modules to covertly persist on a system and evade defenses. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)


Instruction: What is the purpose of the ATT&CK technique Shared Webroot (T1051)?

Input: Windows

Output: **This technique has been deprecated and should no longer be used.**


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Multi-Factor Authentication Request Generation (T1621). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS
IaaS
SaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.


Instruction: What is the purpose of the ATT&CK technique Internet Connection Discovery (T1016.001)?

Input:
Windows
Linux
macOS
ESXi

Output: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), tracert, and GET requests to websites.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Defacement (T1491). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique DLL Side-Loading (T1073). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Programs may specify DLLs that are loaded at runtime. Programs that improperly or vaguely specify a required DLL may be open to a vulnerability in which an unintended DLL is loaded. Side-loading vulnerabilities specifically occur when Windows Side-by-Side (WinSxS) manifests (Citation: MSDN Manifests) are not explicit enough about characteristics of the DLL to be loaded. Adversaries may take advantage of a legitimate program that is vulnerable to side-loading to load a malicious DLL. (Citation: Stewart 2014)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Cloud API (T1059.009). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
IaaS
SaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: Microsoft - Azure PowerShell), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Container Administration Command (T1609). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Containers

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)


Instruction: What is the purpose of the ATT&CK technique Regsvcs/Regasm (T1218.009)?

Input: Windows

Output: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Steal or Forge Kerberos Tickets (T1558). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting.  Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Application Shimming (T1138). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Elastic Process Injection July 2017) Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses [Hooking](https://attack.mitre.org/techniques/T1179) to redirect the code as necessary in order to communicate with the OS.


Instruction: What is the purpose of the ATT&CK technique Network Share Discovery (T1135)?

Input:
macOS
Windows
Linux

Output: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.