can write captured SSH connection credentials to a file under the /var/run directory with a .pid extension for exfiltration. 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: can write captured SSH connection credentials to a file under the /var/run directory with a .pid extension for exfiltration.  ### Response: T1074.