Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0858_change-operating-mode
Adversaries may change the operating mode of a controller to gain additional access to engineering functions such as Program Download.
Passed 20 of 24 test cases with the skill, and 12 of 24 without it.
and 9 more in the full report
8 fixed12 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
An auditor noted that anyone with physical access or network connectivity can switch our Omron PLCs into Program mode. Which MITRE ICS mitigation specifically governs restricting operating mode changes to authorized users using RBAC or physical key switches?
| Checked | Without skill | With skill |
|---|---|---|
| Recommends M0800 Authorization Enforcement for restricting operating mode changes. | Missed | Passed |
| Mentions physical mechanisms like keys to limit unauthorized operating mode changes. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may change the operating mode of a controller to gain additional access to engineering functions such as Program Download. Programmable controllers typically have several modes of operation that control the state of the user program and control access to the controllers API. Operating modes can be physically selected using a key switch on the face of the controller but may also be selected with calls to the controllers API. Operating modes and the mechanisms by which they are selected often vary by vendor and product line. Some commonly implemented operating modes are described below:
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Change Operating Mode by examining operational technology systems and network architecture.
Review whether mitigations for T0858 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
test cases passed, vs 12 / 24 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.