Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Email Account (T1087.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Impersonation (T1656). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
SaaS
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Web Portal Capture (T1056.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Obtain Capabilities (T1588). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Clear Linux or Mac System Logs (T1070.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the <code>/var/log/</code> directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)


Instruction: What is the purpose of the ATT&CK technique DLL (T1574.001)?

Input: Windows

Output: Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.(Citation: unit 42)


Instruction: What is the purpose of the ATT&CK technique Securityd Memory (T1555.002)?

Input:
Linux
macOS

Output: An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization.(Citation: Apple Dev SecurityD) A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Token Impersonation/Theft (T1134.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.


Instruction: What is the purpose of the ATT&CK technique Rundll32 (T1085)?

Input: Windows

Output: The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of whitelists or false positives from Windows using rundll32.exe for normal operations.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Redundant Access (T1108). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
SaaS
IaaS
Linux
macOS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
**This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.**


Instruction: What is the purpose of the ATT&CK technique Path Interception by Search Order Hijacking (T1574.008)?

Input: Windows

Output: Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique External Remote Services (T1133). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
Containers
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Symmetric Cryptography (T1573.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.


Instruction: What is the purpose of the ATT&CK technique Image File Execution Options Injection (T1183)?

Input: Windows

Output: Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\dbg\ntsd.exe -g  notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Mshta (T1218.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Executable Installer File Permissions Weakness (T1574.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.


Instruction: What is the purpose of the ATT&CK technique Scan Databases (T1596.005)?

Input: PRE

Output: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Multi-hop Proxy (T1188). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.


Instruction: What is the purpose of the ATT&CK technique Right-to-Left Override (T1036.002)?

Input:
Linux
macOS
Windows

Output: Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 \u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png.(Citation: Infosecinstitute RTLO Technique)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Trap (T1154). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common  keyboard interrupts like ctrl+c and ctrl+d. Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Malicious Link (T1204.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Mshta (T1170). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). HTA files have the file extension <code>.hta</code>. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)


Instruction: What is the purpose of the ATT&CK technique Hidden Window (T1564.003)?

Input:
macOS
Windows
Linux

Output: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique GUI Input Capture (T1056.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
macOS
Windows
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Authentication Package (T1131). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Windows Authentication Package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system. (Citation: MSDN Authentication Packages)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Dynamic Linker Hijacking (T1574.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.(Citation: Baeldung LD_PRELOAD)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Multilayer Encryption (T1079). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary performs C2 communications using multiple layers of encryption, typically (but not exclusively) tunneling a custom encryption scheme within a protocol encryption scheme such as HTTPS or SMTPS.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Credentials (T1589.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Hidden Window (T1143). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may implement hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse operating system functionality to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.


Instruction: What is the purpose of the ATT&CK technique Screensaver (T1546.002)?

Input: Windows

Output: Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\  on 64-bit Windows systems, along with screensavers included with base Windows installations.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Multiband Communication (T1026). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
**This technique has been deprecated and should no longer be used.**


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Compute Hijacking (T1496.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS
Containers

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Process Injection (T1055). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.


Instruction: What is the purpose of the ATT&CK technique Dynamic API Resolution (T1027.007)?

Input: Windows

Output: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Hardware Additions (T1200). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Launchctl (T1152). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Launchctl controls the macOS launchd process which handles things like launch agents and launch daemons, but can execute other commands or programs itself. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. By loading or reloading launch agents or launch daemons, adversaries can install persistence or execute changes they made  (Citation: Sofacy Komplex Trojan). Running a command from launchctl is as simple as <code>launchctl submit -l <labelName> -- /Path/to/thing/to/execute "arg" "arg" "arg"</code>. Loading, unloading, or reloading launch agents or launch daemons can require elevated privileges.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Regsvr32 (T1218.010). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. (Citation: Microsoft Regsvr32)


Instruction: What is the purpose of the ATT&CK technique Bash History (T1552.003)?

Input:
Linux
macOS

Output: Adversaries may search the bash command history on compromised systems for insecurely stored credentials. Bash keeps track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user’s .bash_history file. For each user, this file resides at the same location: ~/.bash_history. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Data Encrypted for Impact (T1486). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
IaaS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Extra Window Memory Injection (T1181). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data). (Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of extra window memory (EWM) to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Netsh Helper DLL (T1546.007). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.


Instruction: What is the purpose of the ATT&CK technique Disabling Security Tools (T1089)?

Input:
Linux
macOS
Windows

Output: Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Application Deployment Software (T1017). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may deploy malicious software to systems within a network using application deployment systems employed by enterprise administrators. The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the deployment server, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform software deployment.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Login Items (T1547.015). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Web Cookies (T1606.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
SaaS
IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Sharepoint (T1213.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Local Accounts (T1078.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Containers
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Fast Flux DNS (T1568.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity)


Instruction: What is the purpose of the ATT&CK technique Boot or Logon Initialization Scripts (T1037)?

Input:
macOS
Windows
Linux
Network Devices
ESXi

Output: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Spearphishing Link (T1598.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.


Instruction: What is the purpose of the ATT&CK technique Security Support Provider (T1101)?

Input: Windows

Output: Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.


Instruction: What is the purpose of the ATT&CK technique Domain or Tenant Policy Modification (T1484)?

Input:
Windows
Identity Provider

Output: Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or identity federation.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Internal Proxy (T1090.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Network Devices
Windows
macOS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.


Instruction: What is the purpose of the ATT&CK technique Automated Collection (T1119)?

Input:
Linux
macOS
Windows
IaaS
SaaS
Office Suite

Output: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique File Transfer Protocols (T1071.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Time Based Evasion (T1497.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.


Instruction: What is the purpose of the ATT&CK technique Cloud Instance Metadata API (T1552.005)?

Input: IaaS

Output: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Junk Data (T1001.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Outlook Home Page (T1137.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Windows Management Instrumentation Event Subscription (T1546.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.(Citation: Mandiant M-Trends 2015)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Gather Victim Host Information (T1592). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).


Instruction: What is the purpose of the ATT&CK technique Additional Cloud Credentials (T1098.001)?

Input:
IaaS
SaaS
Identity Provider

Output: Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.


Instruction: What is the purpose of the ATT&CK technique Group Policy Modification (T1484.001)?

Input: Windows

Output: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Credential API Hooking (T1056.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001), this technique focuses specifically on API functions that include parameters that reveal user credentials.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Steal Web Session Cookie (T1539). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
SaaS
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Screen Capture (T1113). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Winlogon Helper DLL (T1547.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013)


Instruction: What is the purpose of the ATT&CK technique Network Service Discovery (T1046)?

Input:
Windows
IaaS
Linux
macOS
Containers
Network Devices

Output: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Emond (T1519). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use Event Monitor Daemon (emond) to establish persistence by scheduling malicious commands to run on predictable event triggers. Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1160) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place. The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1160) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Endpoint Denial of Service (T1499). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS
Containers
IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Web Services (T1584.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Recorded Future Turla Infra 2020) Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique IDE Tunneling (T1219.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., `code tunnel`) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.(Citation: sentinelone operationDigitalEye Dec 2024)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Thornton tutorial VSCode shell September 2023)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Internal Spearphishing (T1534). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux
SaaS
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating [Impersonation](https://attack.mitre.org/techniques/T1656).(Citation: Trend Micro - Int SP)


Instruction: What is the purpose of the ATT&CK technique Rename Legitimate Utilities (T1036.003)?

Input:
Linux
macOS
Windows

Output: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Modify Existing Service (T1031). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique NTDS (T1003.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Web Session Cookie (T1506). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Office 365
SaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)


Instruction: What is the purpose of the ATT&CK technique Encrypted/Encoded File (T1027.013)?

Input:
Linux
macOS
Windows

Output: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Steganography](https://attack.mitre.org/techniques/T1027/003), and [Embedded Payloads](https://attack.mitre.org/techniques/T1027/009), share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)) at the time of execution/use.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Exfiltration over USB (T1052.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Security Software Discovery (T1518.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Relocate Malware (T1070.010). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with [File Deletion](https://attack.mitre.org/techniques/T1070/004) to cleanup older artifacts.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Fileless Storage (T1027.011). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless) In Linux systems, shared memory directories such as `/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock` may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk.(Citation: Elastic Binary Executed from Shared Memory Directory)(Citation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik Malware 2024)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Compile After Delivery (T1027.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Break Process Trees (T1036.009). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022)


Instruction: What is the purpose of the ATT&CK technique Accessibility Features (T1015)?

Input: Windows

Output: Windows contains accessibility features that may be launched with a key combination before a user has logged in (for example, when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Binary Padding (T1027.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.


Instruction: What is the purpose of the ATT&CK technique Rc.common (T1163)?

Input: macOS

Output: During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Permission Groups Discovery (T1069). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
SaaS
IaaS
Linux
macOS
Containers
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Installer Packages (T1546.016). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton)


Instruction: What is the purpose of the ATT&CK technique Compression (T1027.015)?

Input:
Linux
Windows
macOS

Output: Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., [Fileless Storage](https://attack.mitre.org/techniques/T1027/011)).(Citation: Trustwave Pillowmint June 2020)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Application or System Exploitation (T1499.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Windows Management Instrumentation Event Subscription (T1084). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Windows Management Instrumentation (WMI) can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. Adversaries may attempt to evade detection of this technique by compiling WMI scripts into Windows Management Object (MOF) files (.mof extension). (Citation: Dell WMI Persistence) Examples of events that may be subscribed to are the wall clock time or the computer's uptime. (Citation: Kazanciyan 2014) Several threat groups have reportedly used this technique to maintain persistence. (Citation: Mandiant M-Trends 2015)


Instruction: What is the purpose of the ATT&CK technique Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003)?

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique InstallUtil (T1118). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>. InstallUtil.exe is digitally signed by Microsoft.


Instruction: What is the purpose of the ATT&CK technique Exfiltration to Text Storage Sites (T1567.003)?

Input:
Linux
macOS
Windows
ESXi

Output: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Acquire Infrastructure (T1583). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost.(Citation: Free Trial PurpleUrchin) Additionally, botnets are available for rent or purchase.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Firmware Corruption (T1495). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique AppleScript (T1059.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Credentials in Registry (T1552.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.


Instruction: What is the purpose of the ATT&CK technique Linux and Mac File and Directory Permissions Modification (T1222.002)?

Input:
macOS
Linux

Output: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Stage Capabilities (T1608). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.(Citation: Volexity Ocean Lotus November 2020)(Citation: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Virtual Private Server (T1583.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure.


Instruction: What is the purpose of the ATT&CK technique Masquerade File Type (T1036.008)?

Input:
Linux
macOS
Windows

Output: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file,  is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`.


Instruction: What is the purpose of the ATT&CK technique HISTCONTROL (T1148)?

Input:
Linux
macOS

Output: The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. This setting can be configured to ignore commands that start with a space by simply setting it to "ignorespace". HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected. Adversaries can use this to operate without leaving traces by simply prepending a space to all of their terminal commands.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Spearphishing Attachment (T1193). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.


Instruction: What is the purpose of the ATT&CK technique Indicator Removal from Tools (T1066)?

Input:
Linux
macOS
Windows

Output: If a malicious tool is detected and quarantined or otherwise curtailed, an adversary may be able to determine why the malicious tool was detected (the indicator), modify the tool by removing the indicator, and use the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Compromise Accounts (T1586). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Code Repositories (T1593.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique /etc/passwd and /etc/shadow (T1003.008). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.(Citation: Linux Password and Shadow File Formats)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Credentials in Registry (T1214). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Web Protocols (T1071.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.


Instruction: What is the purpose of the ATT&CK technique Exclusive Control (T1668)?

Input:
Linux
macOS
Windows

Output: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them  – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Component Object Model and Distributed COM (T1175). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
**This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**


Instruction: What is the purpose of the ATT&CK technique Artificial Intelligence (T1588.007)?

Input: PRE

Output: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI)