Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0886_remote-services
Adversaries may leverage remote services to move between assets and network segments.
Passed 17 of 22 test cases with the skill, and 11 of 22 without it.
and 9 more in the full report
8 fixed9 passed either way3 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
Which matrix platform does MITRE ATT&CK designate for technique T0886 (Remote Services) in industrial environments?
| Checked | Without skill | With skill |
|---|---|---|
| Specify ICS as the platform. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may leverage remote services to move between assets and network segments. These services are often used to allow operators to interact with systems remotely within the network, some examples are RDP, SMB, SSH, and other similar mechanisms.
Remote services could be used to support remote access, data transmission, authentication, name resolution, and other remote functions. Further, remote services may be necessary to allow operators and administrators to configure systems within the network from their engineering or management workstations. An adversary may use this technique to access devices which may be dual-homed to multiple network segments, and can be used for Program Download or to execute attacks on control devices directly through Valid Accounts.
Specific remote services (RDP & VNC) may be a precursor to enable Graphical User Interface execution on devices such as HMIs or engineering workstation software.
Based on incident data, CISA and FBI assessed that Chinese state-sponsored actors also compromised various authorized remote access channels, including systems designed to transfer data and/or allow access between corporate and ICS networks.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Remote Services by examining operational technology systems and network architecture.
Review whether mitigations for T0886 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.