Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0881_service-stop
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
Passed 24 of 25 test cases with the skill, and 11 of 25 without it.
and 18 more in the full report
13 fixed11 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 13 test cases the skill fixed. Same model, same prompt, with and without the skill.
In an industrial control system environment running Windows-based HMI servers, file permissions were left open to non-admin users, allowing modifications to service executables and configs. Which MITRE ATT&CK ICS mitigation ID corresponds to restricting file and directory permissions against service manipulation?
| Checked | Without skill | With skill |
|---|---|---|
| Output specifies mitigation ID M0922. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Service Stop by examining operational technology systems and network architecture.
Review whether mitigations for T0881 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Limit privileges of user accounts and groups so that only authorized administrators can change service states and configurations.
Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.
test cases passed, vs 11 / 25 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.