Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0834_native-api
Adversaries may directly interact with the native OS application programming interface (API) to access system functions.
Passed 19 of 22 test cases with the skill, and 12 of 22 without it.
and 6 more in the full report
7 fixed12 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our risk register requires a single impact classification word for Native API exploitation in SCADA workstations. Security consultants suggested Availability Loss or System Crash. What is the impact classification in the T0834 risk assessment model?
| Checked | Without skill | With skill |
|---|---|---|
| The response designates Execution as the impact. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may directly interact with the native OS application programming interface (API) to access system functions. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Functionality provided by native APIs are often also exposed to user-mode applications via interfaces and libraries. For example, functions such as memcpy and direct operations on memory registers can be used to modify user and system memory space.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Native API by examining operational technology systems and network architecture.
Review whether mitigations for T0834 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Minimize the exposure of API calls that allow the execution of code.
test cases passed, vs 12 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.