Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0848_rogue-master
Adversaries may setup a rogue master to leverage control server functions to communicate with outstations.
Passed 18 of 23 test cases with the skill, and 8 of 23 without it.
and 9 more in the full report
11 fixed7 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
What specific MITRE ATT&CK for ICS mitigation identifier addresses requiring outstation assets and field controllers to authenticate all incoming command messages from master servers?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies M0813 as the mitigation ID for Software Process and Device Authentication. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may setup a rogue master to leverage control server functions to communicate with outstations. A rogue master can be used to send legitimate control messages to other control system devices, affecting processes in unintended ways. It may also be used to disrupt network communications by capturing and receiving the network traffic meant for the actual master. Impersonating a master may also allow an adversary to avoid detection.
In the case of the 2017 Dallas Siren incident, adversaries used a rogue master to send command messages to the 156 distributed sirens across the city, either through a single rogue transmitter with a strong signal, or using many distributed repeaters.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Rogue Master by examining operational technology systems and network architecture.
Review whether mitigations for T0848 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Devices should authenticate all messages between master and outstation assets.
Perform inline allowlisting of automation protocol commands to prevent devices from sending unauthorized command or reporting messages. Allow/denylist techniques need to be designed with sufficient accuracy to prevent the unintended blocking of valid reporting messages.
test cases passed, vs 8 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.