Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0830_adversary-in-the-middle
Adversaries with privileged network access may seek to modify network traffic in real time using adversary-in-the-middle (AiTM) attacks.
Passed 19 of 23 test cases with the skill, and 9 of 23 without it.
and 8 more in the full report
10 fixed9 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
Legacy broadcast protocols and unnecessary network services on field gateways provide vectors for active network traffic redirection. Which MITRE ICS mitigation covers removing or disabling these legacy network protocols?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies mitigation M0942 Disable or Remove Feature or Program. | Missed | Passed |
| Recommends disabling unnecessary legacy network protocols. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries with privileged network access may seek to modify network traffic in real time using adversary-in-the-middle (AiTM) attacks. This type of attack allows the adversary to intercept traffic to and/or from a particular device on the network. If a AiTM attack is established, then the adversary has the ability to block, log, modify, or inject traffic into the communication stream. There are several ways to accomplish this attack, but some of the most-common are Address Resolution Protocol (ARP) poisoning and the use of a proxy.
An AiTM attack may allow an adversary to perform the following attacks: Block Reporting Message, Spoof Reporting Message, Modify Parameter, Unauthorized Command Message
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Adversary-in-the-Middle by examining operational technology systems and network architecture.
Review whether mitigations for T0830 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.
test cases passed, vs 9 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.