Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0855_unauthorized-command-message
Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger thei...
Passed 20 of 22 test cases with the skill, and 10 of 22 without it.
and 10 more in the full report
10 fixed10 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
In an ICS threat model assessment for remote command injection into substation RTUs, Security Operations wanted to classify the adversary action under Initial Access or Reconnaissance. State the precise ATT&CK for ICS kill chain phase for unauthorized command messages.
| Checked | Without skill | With skill |
|---|---|---|
| The kill chain phase is designated as Impair Process Control. | Passed | Passed |
| The phase identifier is specified as TA0106. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an Impact.
In the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Unauthorized Command Message by examining operational technology systems and network architecture.
Review whether mitigations for T0855 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Devices and programs that receive command messages from remote systems (e.g., control servers) should verify those commands before taking any actions on them.
Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment.
test cases passed, vs 10 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.