Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0842_network-sniffing
Network sniffing is the practice of using a network interface on a computer system to monitor or capture information regardless of whether it is the specified destination for the information.
Passed 21 of 23 test cases with the skill, and 13 of 23 without it.
and 8 more in the full report
8 fixed13 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
When building a SIEM monitoring framework for T0842 in ICS environments, how many formal detection strategies are enumerated under the checking procedure?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies 1 detection strategy. | Missed | Passed |
The instructions your model reads when the skill loads.
Network sniffing is the practice of using a network interface on a computer system to monitor or capture information regardless of whether it is the specified destination for the information.
An adversary may attempt to sniff the traffic to gain information about the target. This information can vary in the level of importance. Relatively unimportant information is general communications to and from machines. Relatively important information would be login information. User credentials may be sent over an unencrypted protocol, such as Telnet, that can be captured and obtained through network packet analysis.
In addition, ARP and Domain Name Service (DNS) poisoning can be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Network Sniffing by examining operational technology systems and network architecture.
Review whether mitigations for T0842 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Restrict root or administrator access on user accounts to limit the ability to capture promiscuous traffic on a network through common packet capture tools.
test cases passed, vs 13 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.