Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0836_modify-parameter
Adversaries may modify parameters used to instruct industrial control system devices.
Passed 21 of 24 test cases with the skill, and 9 of 24 without it.
and 14 more in the full report
12 fixed9 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 12 test cases the skill fixed. Same model, same prompt, with and without the skill.
To prevent unauthorized technicians from changing temperature thresholds on PLC controllers, we want to restrict parameter modification rights to designated engineers and enable write protection. Which specific MITRE ATT&CK for ICS mitigation governs authorization enforcement and parameter write protection?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies M0800 Authorization Enforcement as the mitigation for restricting parameter modifications and enabling write protection. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may modify parameters used to instruct industrial control system devices. These devices operate via programs that dictate how and when to perform actions based on such parameters. Such parameters can determine the extent to which an action is performed and may specify additional options. For example, a program on a control system device dictating motor processes may take a parameter defining the total number of seconds to run that motor.
An adversary can potentially modify these parameters to produce an outcome outside of what was intended by the operators. By modifying system and process critical parameters, the adversary may cause Impact to equipment and/or control processes. Modified parameters may be turned into dangerous, out-of-bounds, or unexpected values from typical operations. For example, specifying that a process run for more or less time than it should, or dictating an unusually high, low, or invalid value as a parameter.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Modify Parameter by examining operational technology systems and network architecture.
Review whether mitigations for T0836 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Provide the ability to verify the integrity and authenticity of changes to parameter values.
All field controllers should require that user authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.
test cases passed, vs 9 / 24 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.