Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0851_rootkit
Adversaries may deploy rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
Passed 15 of 22 test cases with the skill, and 8 of 22 without it.
and 6 more in the full report
7 fixed8 passed either way7 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
When auditing our security operations center (SOC) rule set for SCADA systems, how many distinct detection strategies are specified for identifying rootkit subversion in industrial control environments?
| Checked | Without skill | With skill |
|---|---|---|
| States that 1 detection strategy is defined for this rootkit technique. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may deploy rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting and modifying operating-system API calls that supply system information. Rootkits or rootkit-enabling functionality may reside at the user or kernel level in the operating system, or lower.
Firmware rootkits that affect the operating system yield nearly full control of the system. While firmware rootkits are normally developed for the main processing board, they can also be developed for the I/O that is attached to an asset. Compromise of this firmware allows the modification of all of the process variables and functions the module engages in. This may result in commands being disregarded and false information being fed to the main device. By tampering with device processes, an adversary may inhibit its expected response functions and possibly enable Impact.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Rootkit by examining operational technology systems and network architecture.
Review whether mitigations for T0851 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Digital signatures may be used to ensure application DLLs are authentic prior to execution.
test cases passed, vs 8 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.