Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0835_manipulate-io-image
Adversaries may manipulate the I/O image of PLCs through various means to prevent them from functioning as expected.
Passed 20 of 22 test cases with the skill, and 16 of 22 without it.
and 7 more in the full report
5 fixed15 passed either way1 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
When documenting threat models for PLC I/O memory table overriding, enterprise compliance requires assigning a Common Weakness Enumeration ID. Which CWE category specifically applies to T0835 Manipulate I/O Image?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies CWE-400 Uncontrolled Resource Consumption as the designated weakness ID. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may manipulate the I/O image of PLCs through various means to prevent them from functioning as expected. Methods of I/O image manipulation may include overriding the I/O table via direct memory manipulation or using the override function used for testing PLC programs. During the scan cycle, a PLC reads the status of all inputs and stores them in an image table. The image table is the PLCs internal storage location where values of inputs/outputs for one scan are stored while it executes the user program. After the PLC has solved the entire logic program, it updates the output image table. The contents of this output image table are written to the corresponding output points in I/O Modules.
One of the unique characteristics of PLCs is their ability to override the status of a physical discrete input or to override the logic driving a physical output coil and force the output to a desired status.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Manipulate I/O Image by examining operational technology systems and network architecture.
Review whether mitigations for T0835 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
This technique may not be effectively mitigated against, consider controls for assets and processes that lead to the use of this technique.
test cases passed, vs 16 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.