Adversaries may establish command and control capabilities over commonly used application layer protocols such as HTTP(S), OPC, RDP, telnet, DNP3, and modbus.
SkillScore86Maintained
Automatic
◆Security & AppSec packmitre-attackicst0869
Last verified 8/31/2026
What it changes
Passed 19 of 22 test cases with the skill, and 11 of 22 without it.
Without skill50%
With skill86%
Checks it passed that the model alone missed
Rates the risk severity as Low
Classifies the exposure under CWE-300
States that 3 mitigations must be verified
and 7 more in the full report
8 fixed11 passed either way3 still failing0 broke
Pass-rate lift
+36 pp
Tokens
-27%
Agent turns
0%
Response time
-44%
Model gemini-3.6-flashMeasured 8/31/2026v119 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 8
Prompt
A sysadmin proposes using host/system firewall rules specifying IP and MAC address rules for outbound DNP3 traffic. Which MITRE ATT&CK ICS mitigation code corresponds to network allowlists?
What was checked, without and with the skill
Checked
Without skill
With skill
Identifies M0807 as the network allowlists mitigation code
Missed
Passed
case-09 · gemini-3.6-flash · 8/31/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md62 linessingle file
T0869 Standard Application Layer Protocol
High-Level Description
Adversaries may establish command and control capabilities over commonly used application layer protocols such as HTTP(S), OPC, RDP, telnet, DNP3, and modbus. These protocols may be used to disguise adversary actions as benign network traffic. Standard protocols may be seen on their associated port or in some cases over a non-standard port. Adversaries may use these protocols to reach out of the network for command and control, or in some cases to other infected devices within the network.
Kill Chain Phase
Command and Control (TA0101)
Platforms: ICS
What to Check
Identify if Standard Application Layer Protocol technique is applicable to target ICS environment
Check ICS/SCADA systems for indicators of Standard Application Layer Protocol
Verify mitigations are bypassed or absent (3 known mitigations)
Determine if the target ICS/SCADA environment is susceptible to Standard Application Layer Protocol by examining operational technology systems and network architecture.
Assess Existing Defenses
Review whether mitigations for T0869 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Remediation Guide
M0930 Network Segmentation
Ensure proper network segmentation between higher level corporate resources and the control process environment.
M0931 Network Intrusion Prevention
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Adversaries may hook into application programming interface (API) functions used by processes to redirect calls for execution and privilege escalation means.