Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Masquerade Account Name (T1036.010). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
SaaS
IaaS
Containers
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Create Account](https://attack.mitre.org/techniques/T1136), although accounts may also be renamed at a later date. This may also coincide with [Account Access Removal](https://attack.mitre.org/techniques/T1531) if the actor first deletes an account before re-creating one with the same name.(Citation: Huntress MOVEit 2023)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Code Signing Policy Modification (T1553.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.


Instruction: What is the purpose of the ATT&CK technique Exploitation for Privilege Escalation (T1068)?

Input:
Containers
Linux
Windows
macOS

Output: Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Evil Twin (T1557.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or [Input Capture](https://attack.mitre.org/techniques/T1056).(Citation: Australia ‘Evil Twin’)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Scheduled Task/Job (T1053). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS
Containers
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.(Citation: TechNet Task Scheduler Security)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Path Interception (T1034). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
**This technique has been deprecated. Please use [Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007), [Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008), and/or [Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009).**


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Domain Account (T1087.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Exfiltration to Code Repository (T1567.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique PowerShell Profile (T1546.013). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile  (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Transfer Data to Cloud Account (T1537). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
IaaS
SaaS
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Temporary Elevated Cloud Access (T1548.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
IaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Bootkit (T1542.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Golden Ticket (T1558.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Mutual Exclusion (T1480.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.(Citation: Microsoft Mutexes)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Credentials from Password Stores (T1555). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Archive Collected Data (T1560). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Network Provider DLL (T1556.008). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.(Citation: NPPSPY - Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique JamPlus (T1127.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.(Citation: JamPlus manual)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Cloud Groups (T1069.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
SaaS
IaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Disable or Modify Linux Audit System (T1562.012). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detection. Linux admins use the Linux Audit system to track security-relevant information on a system. The Linux Audit system operates at the kernel-level and maintains event logs on application and system activity such as process, network, file, and login events based on pre-configured rules.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Virtual Private Server (T1584.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Re-opened Applications (T1164). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. While this is usually done via a Graphical User Interface (GUI) on an app-by-app basis, there are property list files (plist) that contain this information as well located at ~/Library/Preferences/com.apple.loginwindow.plist and ~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist.


Instruction: What is the purpose of the ATT&CK technique Email Hiding Rules (T1564.008)?

Input:
Windows
Linux
macOS
Office Suite

Output: Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Clear Mailbox Data (T1070.008). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.


Instruction: What is the purpose of the ATT&CK technique Control Panel (T1218.002)?

Input: Windows

Output: Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Data from Local System (T1005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may search local system sources, such as file systems, configuration files, local databases, or virtual machine files, to find files of interest and sensitive data prior to Exfiltration.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Compromise Software Supply Chain (T1195.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.


Instruction: What is the purpose of the ATT&CK technique Credential Stuffing (T1110.004)?

Input:
Windows
SaaS
IaaS
Linux
macOS
Containers
Network Devices
Office Suite
Identity Provider
ESXi

Output: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Firmware (T1592.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.).


Instruction: What is the purpose of the ATT&CK technique Windows Management Instrumentation (T1047)?

Input: Windows

Output: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Securityd Memory (T1167). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords. (Citation: OS X Keychain) (Citation: External to DA, the OS X Way) Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an attacker need only iterate over the other values to unlock the final password. (Citation: OS X Keychain)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Service Execution (T1035). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Cloud Accounts (T1585.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Network Topology (T1590.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure.


Instruction: What is the purpose of the ATT&CK technique Network Share Connection Removal (T1126)?

Input: Windows

Output: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. (Citation: Technet Net Use)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Security Support Provider (T1547.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Unused/Unsupported Cloud Regions (T1535). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.


Instruction: What is the purpose of the ATT&CK technique Social Media (T1593.001)?

Input: PRE

Output: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff.


Instruction: What is the purpose of the ATT&CK technique Uncommonly Used Port (T1065)?

Input:
Linux
macOS
Windows

Output: Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls that have been improperly configured.


Instruction: What is the purpose of the ATT&CK technique Kerberoasting (T1208)?

Input: Windows

Output: Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service (Citation: Microsoft Detecting Kerberoasting Feb 2018)). (Citation: Microsoft SPN) (Citation: Microsoft SetSPN) (Citation: SANS Attacking Kerberos Nov 2014) (Citation: Harmj0y Kerberoast Nov 2016)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Local Account (T1136.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices
Containers
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Additional Cloud Roles (T1098.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
IaaS
SaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)


Instruction: What is the purpose of the ATT&CK technique Custom Command and Control Protocol (T1094)?

Input:
Linux
macOS
Windows

Output: Adversaries may communicate using a custom command and control protocol instead of encapsulating commands/data in an existing [Application Layer Protocol](https://attack.mitre.org/techniques/T1071). Implementations include mimicking well-known protocols or developing custom protocols (including raw sockets) on top of fundamental protocols provided by TCP/IP/another standard network stack.


Instruction: What is the purpose of the ATT&CK technique Bash History (T1139)?

Input:
Linux
macOS

Output: Bash keeps track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user’s .bash_history file. For each user, this file resides at the same location: ~/.bash_history. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Attackers can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Financial Theft (T1657). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
SaaS
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware,(Citation: FBI-ransomware) business email compromise (BEC) and fraud,(Citation: FBI-BEC) "pig butchering,"(Citation: wired-pig butchering) bank hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocurrency networks.(Citation: BBC-Ronin)


Instruction: What is the purpose of the ATT&CK technique Server Software Component (T1505)?

Input:
Windows
Linux
macOS
Network Devices
ESXi

Output: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Exfiltration Over Web Service (T1567). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Office Suite
SaaS
Windows
macOS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Make and Impersonate Token (T1134.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Malvertising (T1583.008). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations  online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising) Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique DNS Server (T1583.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Scheduled Task (T1053.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.(Citation: Stack Overflow) In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.(Citation: Red Canary - Atomic Red Team)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique RDP Hijacking (T1563.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)


Instruction: What is the purpose of the ATT&CK technique Web Shell (T1505.003)?

Input:
Linux
Windows
macOS
Network Devices

Output: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Direct Volume Access (T1006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Network Devices
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique MSBuild (T1127.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Automated Exfiltration (T1020). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020)


Instruction: What is the purpose of the ATT&CK technique Winlogon Helper DLL (T1004)?

Input: Windows

Output: Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software\[Wow6432Node\]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. (Citation: Cylance Reg Persistence Sept 2013)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Gather Victim Identity Information (T1589). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Delete Cloud Instance (T1578.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence.  Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Rundll32 (T1218.011). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).


Instruction: What is the purpose of the ATT&CK technique Cloud Accounts (T1078.004)?

Input:
SaaS
IaaS
Office Suite
Identity Provider

Output: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Bootkit (T1067). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). (Citation: MTrends 2016)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Browser Extensions (T1176.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser. Extensions generally inherit the web browser's permissions previously granted.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Clear Command History (T1146). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. macOS and Linux both keep track of the commands users type in their terminal so that users can retrace what they've done. These logs can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions. Since everything typed on the command-line is saved, passwords passed in on the command line are also saved. Adversaries can abuse this by searching these files for cleartext passwords. Additionally, adversaries can use a variety of methods to prevent their own commands from appear in these logs such as unset HISTFILE, export HISTFILESIZE=0, history -c, rm ~/.bash_history.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Compiled HTML File (T1223). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Event Triggered Execution (T1546). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
SaaS
IaaS
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Phishing for Information (T1598). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique JavaScript (T1059.007). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Stored Data Manipulation (T1565.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique LLMNR/NBT-NS Poisoning and Relay (T1171). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. (Citation: Wikipedia LLMNR) (Citation: TechNet NetBIOS)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Application Layer Protocol (T1071). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Application Access Token (T1550.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
SaaS
Containers
IaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique XPC Services (T1559.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service C API or the high level NSXPCConnection API in order to handle tasks that require elevated privileges (such as network connections). Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services. Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.(Citation: creatingXPCservices)(Citation: Designing Daemons Apple Dev)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Direct Network Flood (T1498.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network. [Direct Network Flood](https://attack.mitre.org/techniques/T1498/001)s are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique System Script Proxy Execution (T1216). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)


Instruction: What is the purpose of the ATT&CK technique SIP and Trust Provider Hijacking (T1198)?

Input: Windows

Output: In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function,  (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Create Account (T1136). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS
Network Devices
Containers
SaaS
Office Suite
Identity Provider
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Cloud Service Discovery (T1526). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
SaaS
IaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Kernel Modules and Extensions (T1547.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.(Citation: Linux Kernel Programming)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Netsh Helper DLL (T1128). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.


Instruction: What is the purpose of the ATT&CK technique Code Repositories (T1213.003)?

Input: SaaS

Output: Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.


Instruction: What is the purpose of the ATT&CK technique Archive via Custom Method (T1560.003)?

Input:
Linux
macOS
Windows

Output: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)


Instruction: What is the purpose of the ATT&CK technique Transmitted Data Manipulation (T1493)?

Input:
Linux
macOS
Windows

Output: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Trap (T1546.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.


Instruction: What is the purpose of the ATT&CK technique LSA Secrets (T1003.004)?

Input: Windows

Output: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Ccache Files (T1558.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Dynamic Data Exchange (T1173). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Windows Dynamic Data Exchange (DDE) is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Modify Registry (T1112). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.


Instruction: What is the purpose of the ATT&CK technique Wi-Fi Discovery (T1016.002)?

Input:
Linux
Windows
macOS

Output: Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087), [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Communication Through Removable Media (T1092). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Direct Cloud VM Connections (T1021.008). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may leverage [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log directly into accessible cloud hosted compute infrastructure through cloud native methods. Many cloud providers offer interactive connections to virtual infrastructure that can be accessed through the [Cloud API](https://attack.mitre.org/techniques/T1059/009), such as Azure Serial Console(Citation: Azure Serial Console), AWS EC2 Instance Connect(Citation: EC2 Instance Connect)(Citation: lucr-3: Getting SaaS-y in the cloud), and AWS System Manager.(Citation: AWS System Manager).


Instruction: What is the purpose of the ATT&CK technique At (Linux) (T1053.001)?

Input: Linux

Output: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial, recurring, or future execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Cloud Application Integration (T1671). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
SaaS
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment. Adversaries may create a custom application, add a legitimate application into the environment, or even co-opt an existing integration to achieve malicious ends.(Citation: Push Security SaaS Persistence 2022)(Citation: SaaS Attacks GitHub Evil Twin Integrations)


Instruction: What is the purpose of the ATT&CK technique Dynamic-link Library Injection (T1055.001)?

Input: Windows

Output: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Authentication Package (T1547.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Internal Defacement (T1491.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)


Instruction: What is the purpose of the ATT&CK technique Data Manipulation (T1565)?

Input:
Linux
macOS
Windows

Output: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: Sygnia Elephant Beetle Jan 2022) By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Process Doppelgänging (T1186). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. (Citation: Microsoft Where to use TxF)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Device Driver Discovery (T1652). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)).


Instruction: What is the purpose of the ATT&CK technique Trusted Relationship (T1199)?

Input:
Windows
SaaS
IaaS
Linux
macOS
Identity Provider
Office Suite

Output: Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique DNS (T1071.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Install Root Certificate (T1553.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.(Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Command and Scripting Interpreter (T1059). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
IaaS
Identity Provider
Linux
Network Devices
Office Suite
Windows
macOS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique AutoHotKey & AutoIT (T1059.010). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.(Citation: AutoIT)(Citation: AutoHotKey)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Outlook Forms (T1137.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Graphical User Interface (T1061). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
**This technique has been deprecated. Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.**


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Stored Data Manipulation (T1492). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may insert, delete, or manipulate data at rest in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Clear Network Connection History and Configurations (T1070.007). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Modify Cloud Compute Configurations (T1578.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Email Addresses (T1589.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique DNS/Passive DNS (T1596.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique LSASS Driver (T1547.008). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Disable or Modify Cloud Logs (T1562.008). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
IaaS
SaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Windows Service (T1543.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Inhibit System Recovery (T1490). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux
Network Devices
IaaS
Containers
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.