Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0846_remote-system-discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for subsequent Lateral Movement or Discovery techniques.
Passed 20 of 23 test cases with the skill, and 10 of 23 without it.
and 14 more in the full report
10 fixed10 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
A security analyst is writing firewall rules to block system discovery probes on an industrial subnet. Besides IT discovery protocols like DHCP and LLDP, which three specific automation protocols with discovery capabilities should be restricted?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies OPC UA Device Discovery as an automation discovery capability to restrict. | Missed | Passed |
| Identifies BACnet as an automation protocol with discovery capabilities to restrict. | Passed | Passed |
| Identifies EtherNet/IP as an automation protocol with discovery capabilities to restrict. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for subsequent Lateral Movement or Discovery techniques. Functionality could exist within adversary tools to enable this, but utilities available on the operating system or vendor software could also be used.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Remote System Discovery by examining operational technology systems and network architecture.
Review whether mitigations for T0846 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
ICS environments typically have more statically defined devices, therefore minimize the use of both IT discovery protocols (e.g., DHCP, LLDP) and discovery functions in automation protocols. Examples of automation protocols with discovery capabilities include OPC UA Device Discovery , BACnet , and Ethernet/IP.
test cases passed, vs 10 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.