Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0863_user-execution
Adversaries may rely on a targeted organizations user interaction for the execution of malicious code.
Passed 19 of 22 test cases with the skill, and 11 of 22 without it.
and 6 more in the full report
8 fixed12 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are configuring application control policies on HMI consoles to block executables that masquerade as benign documents. Which specific MITRE ATT&CK for ICS mitigation identifier corresponds to this application control defense?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies mitigation ID M0938 for execution prevention. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may rely on a targeted organizations user interaction for the execution of malicious code. User interaction may consist of installing applications, opening email attachments, or granting higher permissions to documents.
Adversaries may embed malicious code or visual basic code into files such as Microsoft Word and Excel documents or software installers. Execution of this code requires that the user enable scripting or write access within the document. Embedded code may not always be noticeable to the user especially in cases of trojanized software.
A Chinese spearphishing campaign running from December 9, 2011 through February 29, 2012 delivered malware through spearphishing attachments which required user action to achieve execution.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to User Execution by examining operational technology systems and network architecture.
Review whether mitigations for T0863 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Application control may be able to prevent the running of executables masquerading as other files.
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.