Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0802_automated-collection
Adversaries may automate collection of industrial environment information using tools or scripts.
Passed 17 of 22 test cases with the skill, and 8 of 22 without it.
and 9 more in the full report
9 fixed8 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our OT engineering team believes automated enumeration scripts targeting DNP3 control servers require deploying host-based antivirus on field PLCs. What network-level segmentation mitigation ID from MITRE ATT&CK for ICS prevents unauthorized systems from accessing DNP3 control servers?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies mitigation M0930 for Network Segmentation | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may automate collection of industrial environment information using tools or scripts. This automated collection may leverage native control protocols and tools available in the control systems environment. For example, the OPC protocol may be used to enumerate and gather information. Access to a system or interface with these native protocols may allow collection and enumeration of other attached, communicating servers and devices.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Automated Collection by examining operational technology systems and network architecture.
Review whether mitigations for T0802 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support.
Prevent unauthorized systems from accessing control servers or field devices containing industrial information, especially services used for common automation protocols (e.g., DNP3, OPC).
test cases passed, vs 8 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.