Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0859_valid-accounts
Adversaries may steal the credentials of a specific user or service account using credential access techniques.
Passed 19 of 24 test cases with the skill, and 4 of 24 without it.
and 19 more in the full report
16 fixed3 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 16 test cases the skill fixed. Same model, same prompt, with and without the skill.
When presenting the threat model for T0859 (Valid Accounts in ICS) to executive management, what major historical industrial cyberattack report is cited as a primary reference for this technique?
| Checked | Without skill | With skill |
|---|---|---|
| References the Booz Allen Hamilton report on the Ukraine power grid attack. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may steal the credentials of a specific user or service account using credential access techniques. In some cases, default credentials for control system devices may be publicly available. Compromised credentials may be used to bypass access controls placed on various resources on hosts and within the network, and may even be used for persistent access to remote systems. Compromised and default credentials may also grant an adversary increased privilege to specific systems and devices or access to restricted areas of the network. Adversaries may choose not to use malware or tools, in conjunction with the legitimate access those credentials provide, to make it harder to detect their presence or to control devices and send legitimate commands in an unintended way.
Adversaries may also create accounts, sometimes using predefined account names and passwords, to provide a means of backup access for persistence.
The overlap of credentials and permissions across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) and possibly between the enterprise and operational technology environments. Adversaries may be able to leverage valid credentials from one system to gain access to another system.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Valid Accounts by examining operational technology systems and network architecture.
Review whether mitigations for T0859 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.
test cases passed, vs 4 / 24 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.