Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique LNK Icon Smuggling (T1027.012). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Service Stop (T1489). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Install Digital Certificate (T1608.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.(Citation: DigiCert Install SSL Cert)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Lateral Tool Transfer (T1570). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Spearphishing Link (T1192). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux
Office 365
SaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Dynamic Data Exchange (T1559.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.


Instruction: What is the purpose of the ATT&CK technique Revert Cloud Instance (T1536)?

Input: IaaS

Output: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Transmitted Data Manipulation (T1565.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Private Keys (T1145). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. (Citation: Wikipedia Public Key Crypto)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Obfuscated Files or Information (T1027). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique System Firmware (T1019). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Spearphishing Voice (T1598.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Business Relationships (T1591.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources.


Instruction: What is the purpose of the ATT&CK technique Spearphishing via Service (T1566.003)?

Input:
Linux
macOS
Windows

Output: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Compromise Hardware Supply Chain (T1195.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Exploitation for Credential Access (T1212). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Hypervisor CLI (T1059.012). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts.


Instruction: What is the purpose of the ATT&CK technique SID-History Injection (T1178)?

Input: Windows

Output: The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Data from Information Repositories (T1213). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS
SaaS
IaaS
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., [Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537)).


Instruction: What is the purpose of the ATT&CK technique Digital Certificates (T1596.003)?

Input: PRE

Output: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Verclsid (T1218.012). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Device Registration (T1098.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Network Device Configuration Dump (T1602.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Email Forwarding Rule (T1114.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules)


Instruction: What is the purpose of the ATT&CK technique Exploit Public-Facing Application (T1190)?

Input:
Containers
IaaS
Linux
Network Devices
Windows
macOS
ESXi

Output: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Socket Filters (T1205.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket. The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell.


Instruction: What is the purpose of the ATT&CK technique Python (T1059.006)?

Input:
Linux
Windows
macOS
ESXi

Output: Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Reduce Key Space (T1600.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique LSASS Memory (T1003.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique New Service (T1050). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
When operating systems boot up, they can start programs or applications called services that perform background system functions. (Citation: TechNet Services) A service's configuration information, including the file path to the service's executable, is stored in the Windows Registry.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Logon Script (Windows) (T1037.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.(Citation: Hexacorn Logon Scripts)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Service Execution (T1569.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and [Net](https://attack.mitre.org/software/S0039).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Compiled HTML File (T1218.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)


Instruction: What is the purpose of the ATT&CK technique Domains (T1583.001)?

Input: PRE

Output: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Subvert Trust Controls (T1553). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Content Injection (T1659). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) followed by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and other data to already compromised systems.(Citation: ESET MoustachedBouncer)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Port Knocking (T1205.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Data Compressed (T1002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. The compression is done separately from the exfiltration channel and is performed using a custom program or algorithm, or a more common compression library or utility such as 7zip, RAR, ZIP, or zlib.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Odbcconf (T1218.008). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Network Devices (T1584.008). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment -- instead leveraging these devices to support additional targeting.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Multi-Factor Authentication (T1556.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
SaaS
IaaS
Linux
macOS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Scheduled Transfer (T1029). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Search Closed Sources (T1597). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ZDNET Selling Data)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Email Bombing (T1667). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Office Suite
Windows
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bury legitimate emails in a flood of spam and disrupt business operations.(Citation: sophos-bombing)(Citation: krebs-email-bombing)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique External Defacement (T1491.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique System Shutdown/Reboot (T1529). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Launch Daemon (T1160). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique System Checks (T1497.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Lua (T1059.011). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded programs (through the struct lua_State).(Citation: Lua main page)(Citation: Lua state)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Query Registry (T1012). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Login Hook (T1037.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Server (T1583.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Server (T1584.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.(Citation: TrendMicro EarthLusca 2022) Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations.


Instruction: What is the purpose of the ATT&CK technique DCSync (T1003.006)?

Input: Windows

Output: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Upload Malware (T1608.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.


Instruction: What is the purpose of the ATT&CK technique Commonly Used Port (T1043)?

Input:
Linux
macOS
Windows

Output: **This technique has been deprecated. Please use [Non-Standard Port](https://attack.mitre.org/techniques/T1571) where appropriate.**


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique LSASS Driver (T1177). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. (Citation: Microsoft Security Subsystem)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Credentials from Web Browsers (T1555.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique XDG Autostart Entries (T1547.013). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login. These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.(Citation: Free Desktop Application Autostart Feb 2006)(Citation: Free Desktop Entry Keys)


Instruction: What is the purpose of the ATT&CK technique Cron (T1053.003)?

Input:
Linux
macOS
ESXi

Output: Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The cron utility is a time-based job scheduler for Unix-like operating systems.  The  crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Proxy (T1090). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Run Virtual Instance (T1564.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance.(Citation: CyberCX Akira Ransomware) Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Data Obfuscation (T1001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Registry Run Keys / Startup Folder (T1547.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique InstallUtil (T1218.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Shortcut Modification (T1023). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.


Instruction: What is the purpose of the ATT&CK technique Digital Certificates (T1588.004)?

Input: PRE

Output: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Resource Forking (T1564.009). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Path Interception by PATH Environment Variable (T1574.007). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line.


Instruction: What is the purpose of the ATT&CK technique Setuid and Setgid (T1548.001)?

Input:
Linux
macOS

Output: An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page) Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique System Services (T1569). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Web Service (T1102). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Data Destruction (T1485). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS
Containers
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique NTFS File Attributes (T1564.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)


Instruction: What is the purpose of the ATT&CK technique Clipboard Data (T1115)?

Input:
Linux
Windows
macOS

Output: Adversaries may collect data stored in the clipboard from users copying information within or between applications.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Valid Accounts (T1078). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
SaaS
IaaS
Linux
macOS
Containers
Network Devices
Office Suite
Identity Provider
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Print Processors (T1547.012). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Ignore Process Interrupts (T1564.011). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man)  These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes.


Instruction: What is the purpose of the ATT&CK technique Ptrace System Calls (T1055.008)?

Input: Linux

Output: Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Process Hollowing (T1055.012). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Forge Web Credentials (T1606). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
SaaS
Windows
macOS
Linux
IaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Steal Application Access Token (T1528). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
SaaS
Containers
IaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.


Instruction: What is the purpose of the ATT&CK technique Software Discovery (T1518)?

Input:
Windows
IaaS
Linux
macOS
ESXi

Output: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Kerberoasting (T1558.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to [Brute Force](https://attack.mitre.org/techniques/T1110).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Code Signing Certificates (T1587.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Local Job Scheduling (T1168). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron, (Citation: Die.net Linux crontab Man Page) at, (Citation: Die.net Linux at Man Page) and launchd. (Citation: AppleDocs Scheduling Timed Jobs) Unlike [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) on Windows systems, job scheduling on Linux-based systems cannot be done remotely unless used in conjunction within an established remote session, like secure shell (SSH).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Protocol Tunneling (T1572). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique ROMMONkit (T1542.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks)


Instruction: What is the purpose of the ATT&CK technique Extra Window Memory Injection (T1055.011)?

Input: Windows

Output: Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Exfiltration Over Bluetooth (T1011.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Traffic Duplication (T1020.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Network Devices
IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Masquerading (T1036). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Containers
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Parent PID Spoofing (T1134.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.(Citation: Microsoft UAC Nov 2018)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Disable or Modify System Firewall (T1562.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Network Devices
Windows
macOS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique COR_PROFILER (T1574.012). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profilers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Clear Windows Event Logs (T1070.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Unix Shell Configuration Modification (T1546.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Default Accounts (T1078.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
SaaS
IaaS
Linux
macOS
Containers
Network Devices
Office Suite
Identity Provider
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.(Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS Root User)(Citation: Threat Matrix for Kubernetes)


Instruction: What is the purpose of the ATT&CK technique Cloud Accounts (T1586.003)?

Input: PRE

Output: Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Additionally, cloud-based messaging services such as Twilio, SendGrid, AWS End User Messaging, AWS SNS (Simple Notification Service), or AWS SES (Simple Email Service) may be leveraged for spam or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)(Citation: Netcraft SendGrid 2024) Compromising cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Disk Structure Wipe (T1487). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may corrupt or wipe the disk data structures on hard drive necessary to boot systems; targeting specific critical systems as well as a large number of systems in a network to interrupt availability to system and network resources.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Malware (T1587.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Impair Defenses (T1562). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS
Containers
Network Devices
Identity Provider
Office Suite
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.


Instruction: What is the purpose of the ATT&CK technique Ingress Tool Transfer (T1105)?

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output: Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Invalid Code Signature (T1036.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017)


Instruction: What is the purpose of the ATT&CK technique Indicator Blocking (T1054)?

Input: Windows

Output: An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting (Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW),(Citation: Microsoft About Event Tracing 2018) by tampering settings that control the collection and flow of event telemetry. (Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1086) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).


Instruction: What is the purpose of the ATT&CK technique Steal or Forge Authentication Certificates (T1649)?

Input:
Windows
Linux
macOS
Identity Provider

Output: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.(Citation: O365 Blog Azure AD Device IDs)(Citation: Microsoft AD CS Overview)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique KernelCallbackTable (T1574.013). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads.(Citation: Lazarus APT January 2022)(Citation: FinFisher exposed ) The KernelCallbackTable can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once user32.dll is loaded.(Citation: Windows Process Injection KernelCallbackTable)


Instruction: What is the purpose of the ATT&CK technique Image File Execution Options Injection (T1546.012)?

Input: Windows

Output: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., C:\dbg\ntsd.exe -g  notepad.exe). (Citation: Microsoft Dev Blog IFEO Mar 2010)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique PowerShell (T1059.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).