Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0817_drive-by-compromise
Adversaries may gain access to a system during a drive-by compromise, when a user visits a website as part of a regular browsing session.
Passed 18 of 22 test cases with the skill, and 9 of 22 without it.
and 9 more in the full report
9 fixed9 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
What is the MITRE ATT&CK tactic ID and kill chain phase for technique T0817 Drive-by Compromise in industrial control environments?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies Initial Access as the kill chain phase. | Missed | Passed |
| Includes tactic ID TA0108. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may gain access to a system during a drive-by compromise, when a user visits a website as part of a regular browsing session. With this technique, the user's web browser is targeted and exploited simply by visiting the compromised website.
The adversary may target a specific community, such as trusted third party suppliers or other industry specific groups, which often visit the target website. This kind of targeted attack relies on a common interest, and is known as a strategic web compromise or watering hole attack.
The National Cyber Awareness System (NCAS) has issued a Technical Alert (TA) regarding Russian government cyber activity targeting critical infrastructure sectors. Analysis by DHS and FBI has noted two distinct categories of victims in the Dragonfly campaign on the Western energy sector: staging and intended targets. The adversary targeted the less secure networks of staging targets, including trusted third-party suppliers and related peripheral organizations. Initial access to the intended targets used watering hole attacks to target process control, ICS, and critical infrastructure related trade publications and informational websites.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Drive-by Compromise by examining operational technology systems and network architecture.
Review whether mitigations for T0817 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Ensure all browsers and plugins are kept updated to help prevent the exploit phase of this technique. Use modern browsers with security features enabled.
test cases passed, vs 9 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.