Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0801_monitor-process-state
Adversaries may gather information about the physical process state.
Passed 20 of 22 test cases with the skill, and 11 of 22 without it.
and 11 more in the full report
9 fixed11 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
An adversary gained read-only access to a plant historian and extracted 6 months of continuous temperature and pressure process logs. Under which MITRE ATT&CK for ICS tactic phase should this process state monitoring activity be logged?
| Checked | Without skill | With skill |
|---|---|---|
| Categorizes the activity under the Collection (TA0100) tactic. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may gather information about the physical process state. This information may be used to gain more information about the process itself or used as a trigger for malicious actions. The sources of process state information may vary such as, OPC tags, historian data, specific PLC block information, or network traffic.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Monitor Process State by examining operational technology systems and network architecture.
Review whether mitigations for T0801 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.