Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0814_denial-of-service
Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality.
Passed 19 of 22 test cases with the skill, and 12 of 22 without it.
and 7 more in the full report
7 fixed12 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
A field technician reports that remote legacy serial-to-Ethernet converters freeze when receiving burst traffic, requiring manual power cycling on-site. The IT network team suggested putting a software firewall in front of every serial bridge, but OT engineering wants the standard M-series ATT&CK for ICS mitigation for timeout-induced device hangs. What specific MITRE mitigation is designated for this condition and what action does it execute?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies mitigation M0815 Watchdog Timers. | Missed | Passed |
| States that watchdog timers trigger system or process restarts upon a timeout condition. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality. Examples of DoS attacks include overwhelming the target device with a high volume of requests in a short time period and sending the target device a request it does not know how to handle. Disrupting device state may temporarily render it unresponsive, possibly lasting until a reboot can occur. When placed in this state, devices may be unable to send and receive requests, and may not perform expected response functions in reaction to other events in the environment.
Some ICS devices are particularly sensitive to DoS events, and may become unresponsive in reaction to even a simple ping sweep. Adversaries may also attempt to execute a Permanent Denial-of-Service (PDoS) against certain devices, such as in the case of the BrickerBot malware.
Adversaries may exploit a software vulnerability to cause a denial of service by taking advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in software that can be used to cause a denial of service condition.
Adversaries may have prior knowledge about industrial protocols or control devices used in the environment through Remote System Information Discovery. There are examples of adversaries remotely causing a Device Restart/Shutdown by exploiting a vulnerability that induces uncontrolled resource consumption.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Denial of Service by examining operational technology systems and network architecture.
Review whether mitigations for T0814 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
System and process restarts should be performed when a timeout condition occurs.
test cases passed, vs 12 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.