Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0800_activate-firmware-update-mode
Adversaries may activate firmware update mode on devices to prevent expected response functions from engaging in reaction to an emergency or process malfunction.
Passed 16 of 22 test cases with the skill, and 7 of 22 without it.
and 8 more in the full report
10 fixed6 passed either way5 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our SCADA management software automatically polls PLCs and pushes mode changes. Which mitigation ID ensures the PLC verifies the legitimacy of the software client before entering update mode?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies M0813 Software Process and Device Authentication | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may activate firmware update mode on devices to prevent expected response functions from engaging in reaction to an emergency or process malfunction. For example, devices such as protection relays may have an operation mode designed for firmware installation. This mode may halt process monitoring and related functions to allow new firmware to be loaded. A device left in update mode may be placed in an inactive holding state if no firmware is provided to it. By entering and leaving a device in this mode, the adversary may deny its usual functionalities.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Activate Firmware Update Mode by examining operational technology systems and network architecture.
Review whether mitigations for T0800 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.
Devices that allow remote management of firmware should require authentication before allowing any changes. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management
test cases passed, vs 7 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.