Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0809_data-destruction
Adversaries may perform data destruction over the course of an operation.
Passed 17 of 22 test cases with the skill, and 7 of 22 without it.
and 16 more in the full report
10 fixed7 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our compliance software requires linking MITRE ICS T0809 Data Destruction to Common Weakness Enumeration identifiers. Many security tools auto-assign access control flaws like CWE-284 or CWE-732 to data wiping. Provide the exact CWE category defined for T0809 in ICS assessment frameworks and explain why it applies.
| Checked | Without skill | With skill |
|---|---|---|
| Identifies CWE-400 Uncontrolled Resource Consumption as the applicable CWE category. | Missed | Passed |
| Refrains from designating CWE-284 as the primary CWE category. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may perform data destruction over the course of an operation. The adversary may drop or create malware, tools, or other non-native files on a target system to accomplish this, potentially leaving behind traces of malicious activities. Such non-native files and other data may be removed over the course of an intrusion to maintain a small footprint or as a standard part of the post-intrusion cleanup process.
Data destruction may also be used to render operator interfaces unable to respond and to disrupt response functions from occurring as expected. An adversary may also destroy data backups that are vital to recovery after an incident.
Standard file deletion commands are available on most operating system and device interfaces to perform cleanup, but adversaries may use other tools as well. Two examples are Windows Sysinternals SDelete and Active@ Killdisk.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Data Destruction by examining operational technology systems and network architecture.
Review whether mitigations for T0809 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Protect files stored locally with proper permissions to limit opportunities for adversaries to impact data storage.
test cases passed, vs 7 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.