Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0811_data-from-information-repositories
Adversaries may target and collect data from information repositories.
Passed 18 of 21 test cases with the skill, and 7 of 21 without it.
and 18 more in the full report
15 fixed4 passed either way0 still failing3 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 14 test cases the skill fixed. Same model, same prompt, with and without the skill.
Adversaries often attempt to read raw database files storing RTU configurations on process historians. What specific MITRE ICS mitigation targets file and directory permissions to limit adversary access to database files?
| Checked | Without skill | With skill |
|---|---|---|
| The response specifies mitigation M0922 Restrict File and Directory Permissions. | Missed | Passed |
| The response recommends setting file permissions to limit adversary database collection. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may target and collect data from information repositories. This can include sensitive data such as specifications, schematics, or diagrams of control system layouts, devices, and processes. Examples of information repositories include reference databases in the process environment, as well as databases in the corporate network that might contain information about the ICS.
Information collected from these systems may provide the adversary with a better understanding of the operational environment, vendors used, processes, or procedures of the ICS.
In a campaign between 2011 and 2013 against ONG organizations, Chinese state-sponsored actors searched document repositories for specific information such as, system manuals, remote terminal unit (RTU) sites, personnel lists, documents that included the string SCAD*, user credentials, and remote dial-up access information.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Data from Information Repositories by examining operational technology systems and network architecture.
Review whether mitigations for T0811 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Consider periodic reviews of accounts and privileges for critical and sensitive repositories.
test cases passed, vs 7 / 21 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.