Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0877_io-image
Adversaries may seek to capture process values related to the inputs and outputs of a PLC.
Passed 17 of 22 test cases with the skill, and 10 of 22 without it.
and 11 more in the full report
8 fixed9 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are compiling an OT hardening checklist. For MITRE ATT&CK for ICS technique T0877, how many specific known mitigations and detection strategies are recognized in the core technique profile?
| Checked | Without skill | With skill |
|---|---|---|
| State that there is 1 known mitigation. | Missed | Passed |
| State that there is 1 detection strategy. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may seek to capture process values related to the inputs and outputs of a PLC. During the scan cycle, a PLC reads the status of all inputs and stores them in an image table. The image table is the PLCs internal storage location where values of inputs/outputs for one scan are stored while it executes the user program. After the PLC has solved the entire logic program, it updates the output image table. The contents of this output image table are written to the corresponding output points in I/O Modules.
The Input and Output Image tables described above make up the I/O Image on a PLC. This image is used by the user program instead of directly interacting with physical I/O.
Adversaries may collect the I/O Image state of a PLC by utilizing a devices Native API to access the memory regions directly. The collection of the PLCs I/O state could be used to replace values or inform future stages of an attack.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to I/O Image by examining operational technology systems and network architecture.
Review whether mitigations for T0877 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
This technique may not be effectively mitigated against, consider controls for assets and processes that lead to the use of this technique.
test cases passed, vs 10 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.