Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0856_spoof-reporting-message
Adversaries may spoof reporting messages in control system environments for evasion and to impair process control.
Passed 22 of 24 test cases with the skill, and 13 of 24 without it.
and 7 more in the full report
9 fixed13 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
To protect telemetry updates between master stations and outstation assets from being spoofed, what MITRE ATT&CK ICS mitigation focuses directly on authenticating messages between master and outstation devices?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies M0813 Software Process and Device Authentication. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may spoof reporting messages in control system environments for evasion and to impair process control. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. Reporting messages are important for monitoring the normal operation of a system or identifying important events such as deviations from expected values.
If an adversary has the ability to Spoof Reporting Messages, they can impact the control system in many ways. The adversary can Spoof Reporting Messages that state that the process is operating normally, as a form of evasion. The adversary could also Spoof Reporting Messages to make the defenders and operators think that other errors are occurring in order to distract them from the actual source of a problem.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Spoof Reporting Message by examining operational technology systems and network architecture.
Review whether mitigations for T0856 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Devices should authenticate all messages between master and outstation assets.
test cases passed, vs 13 / 24 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.