Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique SEO Poisoning (T1608.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.(Citation: Atlas SEO)(Citation: MalwareBytes SEO)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Confluence (T1213.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: SaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Domain Account (T1136.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Component Object Model Hijacking (T1122). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
The Component Object Model (COM) is a system within Windows to enable interaction between software components through the operating system. (Citation: Microsoft Component Object Model) Adversaries can use this system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Windows Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead. (Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Local Data Staging (T1074.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique File System Permissions Weakness (T1044). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Steganography (T1027.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.


Instruction: What is the purpose of the ATT&CK technique Hidden File System (T1564.005)?

Input:
Linux
macOS
Windows

Output: Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.(Citation: MalwareTech VFS Nov 2014)


Instruction: What is the purpose of the ATT&CK technique Create Snapshot (T1578.001)?

Input: IaaS

Output: An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Software (T1592.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Cloud Infrastructure Discovery (T1580). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Forced Authentication (T1187). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Masquerade Task or Service (T1036.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Password Filter DLL (T1556.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Services Registry Permissions Weakness (T1574.011). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe,  [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique RC Scripts (T1037.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
macOS
Linux
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Gather Victim Org Information (T1591). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Wordlist Scanning (T1595.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Startup Items (T1165). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Per Apple’s documentation, startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items (Citation: Startup Items). This is technically a deprecated version (superseded by Launch Daemons), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique AppInit DLLs (T1103). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Disk Structure Wipe (T1561.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Domain Controller Authentication (T1556.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Multi-hop Proxy (T1090.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Network Devices
Windows
macOS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique System Location Discovery (T1614). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS
IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer


Instruction: What is the purpose of the ATT&CK technique Input Prompt (T1141)?

Input:
macOS
Windows

Output: When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1088)).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Search Open Technical Databases (T1596). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique AppInit DLLs (T1546.010). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017)


Instruction: What is the purpose of the ATT&CK technique Process Discovery (T1057)?

Input:
Linux
Network Devices
Windows
macOS
ESXi

Output: Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Rootkit (T1014). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Launchd (T1053.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself.


Instruction: What is the purpose of the ATT&CK technique Change Default File Association (T1546.001)?

Input: Windows

Output: Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility.(Citation: Microsoft Change Default Programs)(Citation: Microsoft File Handlers)(Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Software Packing (T1027.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
macOS
Windows
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Compile After Delivery (T1500). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Similar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Network Sniffing (T1040). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices
IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique System Network Connections Discovery (T1049). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
IaaS
Linux
macOS
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.


Instruction: What is the purpose of the ATT&CK technique Double File Extension (T1036.007)?

Input: Windows

Output: Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: File.txt.exe may render in some views as just File.txt). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Windows Remote Management (T1021.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Local Account (T1087.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.


Instruction: What is the purpose of the ATT&CK technique ClickOnce (T1127.002)?

Input: Windows

Output: Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Social Media Accounts (T1586.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001)), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique External Proxy (T1090.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Access Token Manipulation (T1134). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.


Instruction: What is the purpose of the ATT&CK technique Fallback Channels (T1008)?

Input:
Linux
Windows
macOS
ESXi

Output: Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Gather Victim Network Information (T1590). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Cloud Account (T1087.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
SaaS
IaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Data Encoding (T1132). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Pluggable Authentication Modules (T1556.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Install Root Certificate (T1130). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Indirect Command Execution (T1202). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts.(Citation: VectorSec ForFiles Aug 2017)(Citation: Evi1cg Forfiles Nov 2017)(Citation: Secure Team - Scriptrunner.exe)(Citation: SS64)(Citation: Bleeping Computer - Scriptrunner.exe) Adversaries may also abuse the `ssh.exe` binary to execute malicious commands via the `ProxyCommand` and `LocalCommand` options, which can be invoked via the `-o` flag or by modifying the SSH config file.(Citation: Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Remote Services (T1021). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
IaaS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.


Instruction: What is the purpose of the ATT&CK technique Clear Command History (T1070.003)?

Input:
Linux
macOS
Windows
Network Devices
ESXi

Output: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique NTFS File Attributes (T1096). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Hypervisor (T1062). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
**This technique has been deprecated and should no longer be used.**


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Abuse Elevation Control Mechanism (T1548). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
IaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Email Spoofing (T1672). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Office Suite
Windows
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.(Citation: Proofpoint TA427 April 2024) In addition to actual email content, email headers (such as the FROM header, which contains the email address of the sender) may also be modified. Email clients display these headers when emails appear in a victim's inbox, which may cause modified emails to appear as if they were from the spoofed entity.


Instruction: What is the purpose of the ATT&CK technique Browser Session Hijacking (T1185)?

Input: Windows

Output: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.(Citation: Wikipedia Man in the Browser)


Instruction: What is the purpose of the ATT&CK technique DLL Search Order Hijacking (T1038)?

Input: Windows

Output: Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft DLL Search) Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Downgrade Attack (T1562.010). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Linux
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Cloud Account (T1136.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
IaaS
SaaS
Office Suite
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique AppCert DLLs (T1182). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Elastic Process Injection July 2017)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Timestomp (T1099). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may take actions to hide the deployment of new, or modification of existing files to obfuscate their activities. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools. Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools. (Citation: WindowsIR Anti-Forensic Techniques)


Instruction: What is the purpose of the ATT&CK technique SMS Pumping (T1496.003)?

Input: SaaS

Output: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Launch Agent (T1543.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique System Owner/User Discovery (T1033). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Elevated Execution with Prompt (T1514). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating.  This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified. Although this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.


Instruction: What is the purpose of the ATT&CK technique Spearphishing Attachment (T1566.001)?

Input:
macOS
Windows
Linux

Output: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.(Citation: Unit 42 DarkHydrus July 2018) Spearphishing may also involve social engineering techniques, such as posing as a trusted source.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Port Monitors (T1547.010). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in C:\Windows\System32 and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Time Providers (T1547.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider)


Instruction: What is the purpose of the ATT&CK technique Modify System Image (T1601)?

Input: Network Devices

Output: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.  On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Email Collection (T1114). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.(Citation: TrustedSec OOB Communications)(Citation: CISA AA20-352A 2021) Adversaries can collect or forward email from mail servers or clients.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Publish/Subscribe Protocols (T1071.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
macOS
Linux
Windows
Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Component Firmware (T1109). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1019) but conducted upon other system components that may not have the same capability or level of integrity checking. Malicious device firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.


Instruction: What is the purpose of the ATT&CK technique Audio Capture (T1123)?

Input:
Linux
macOS
Windows

Output: An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.(Citation: ESET Attor Oct 2019)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Software Packing (T1045). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Native API (T1106). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique SID-History Injection (T1134.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique SIP and Trust Provider Hijacking (T1553.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function,  (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Trust Modification (T1484.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
Identity Provider

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow authentication and authorization properties to apply between domains or tenants for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.


Instruction: What is the purpose of the ATT&CK technique Dead Drop Resolver (T1102.001)?

Input:
Linux
macOS
Windows
ESXi

Output: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Overwrite Process Arguments (T1036.011). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc/<PID>/cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Hide Artifacts (T1564). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Office Suite
Windows
macOS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015)


Instruction: What is the purpose of the ATT&CK technique Cloud Service Dashboard (T1538)?

Input:
IaaS
SaaS
Office Suite
Identity Provider

Output: An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, review findings of potential security risks, and run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique File Deletion (T1070.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Execution Guardrails (T1480). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019)


Instruction: What is the purpose of the ATT&CK technique Bandwidth Hijacking (T1496.002)?

Input:
Linux
Windows
macOS
IaaS
Containers

Output: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Domain Groups (T1069.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Create or Modify System Process (T1543). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
macOS
Linux
Containers

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons)


Instruction: What is the purpose of the ATT&CK technique Exfiltration Over Symmetric Encrypted Non-C2 Protocol (T1048.001)?

Input:
Linux
macOS
Windows
ESXi

Output: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Application Window Discovery (T1010). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
macOS
Windows
Linux

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Elevated Execution with Prompt (T1548.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: macOS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Protocol or Service Impersonation (T1001.003). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.


Instruction: What is the purpose of the ATT&CK technique Hidden Files and Directories (T1158)?

Input:
Linux
macOS
Windows

Output: To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Spearphishing Link (T1566.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
SaaS
Identity Provider
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Taint Shared Content (T1080). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Windows
SaaS
Linux
macOS
Office Suite

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer


Instruction: What is the purpose of the ATT&CK technique Group Policy Discovery (T1615)?

Input: Windows

Output: Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Virtual Machine Discovery (T1673). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd vmsvc/getallvms`).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: TrendMicro Play) Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique MMC (T1218.014). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt.(Citation: win_mmc)(Citation: what_is_mmc) MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration.(Citation: win_msc_files_overview)


Instruction: What is the purpose of the ATT&CK technique IIS Components (T1505.004)?

Input: Windows

Output: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers.(Citation: Microsoft ISAPI Extension Overview 2017)(Citation: Microsoft ISAPI Filter Overview 2017)(Citation: IIS Backdoor 2011)(Citation: Trustwave IIS Module 2013)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Steganography (T1001.002). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Clear Persistence (T1070.009). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
ESXi

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Network Share Connection Removal (T1070.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Windows

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. (Citation: Technet Net Use)


Instruction: What is the purpose of the ATT&CK technique Hidden Users (T1564.002)?

Input:
macOS
Windows
Linux

Output: Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Threat Intel Vendors (T1597.001). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Private Keys (T1552.004). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
macOS
Windows
Network Devices

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.


Instruction: What is the purpose of the ATT&CK technique At (T1053.002)?

Input:
Windows
Linux
macOS

Output: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s [schtasks](https://attack.mitre.org/software/S0111) in Windows environments, using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group. In addition to explicitly running the `at` command, adversaries may also schedule a task with [at](https://attack.mitre.org/software/S0110) by directly leveraging the [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) `Win32_ScheduledJob` WMI class.(Citation: Malicious Life by Cybereason)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Exploits (T1588.005). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: PRE

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.(Citation: Exploit Database)(Citation: TempertonDarkHotel)(Citation: NationsBuying)


Instruction: What is the purpose of the ATT&CK technique Cloud Storage Object Discovery (T1619)?

Input: IaaS

Output: Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage.  Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure.


Instruction: What is the purpose of the ATT&CK technique Develop Capabilities (T1587)?

Input: PRE

Output: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Additional Container Cluster Roles (T1098.006). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input: Containers

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC)


Instruction: What is the purpose of the ATT&CK technique Msiexec (T1218.007)?

Input: Windows

Output: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) The Msiexec.exe binary may also be digitally signed by Microsoft.


Instruction: You are a cyber‑threat intelligence analyst. Explain in a multi‑step reasoning style how an adversary could leverage the ATT&CK technique Exploitation for Defense Evasion (T1211). Describe the attacker’s goal, prerequisites, execution, and outline at least two concrete mitigations. Provide your reasoning before the final answer under a ‘### Answer’ heading.

Input:
Linux
Windows
macOS
SaaS
IaaS

Output:
First, let’s understand what the technique is trying to achieve.
—  … (insert step‑by‑step analysis)

### Answer
Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.