Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0889_modify-program
Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network.
Passed 18 of 22 test cases with the skill, and 12 of 22 without it.
and 8 more in the full report
6 fixed12 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
When evaluating defense posture against unauthorized PLC logic edits, how many distinct detection strategies are documented in the evaluation framework for T0889?
| Checked | Without skill | With skill |
|---|---|---|
| States that there is 1 detection strategy documented. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network. Modification to controller programs can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append.
Program modification encompasses the addition and modification of instructions and logic contained in Program Organization Units (POU) and similar programming elements found on controllers. This can include, for example, adding new functions to a controller, modifying the logic in existing functions and making new calls from one function to another.
Some programs may allow an adversary to interact directly with the native API of the controller to take advantage of obscure features or vulnerabilities.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Modify Program by examining operational technology systems and network architecture.
Review whether mitigations for T0889 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Provide the ability to verify the integrity of control logic or programs loaded on a controller. While techniques like CRCs and checksums are commonly used, they are not cryptographically strong and can be vulnerable to collisions. Preferably cryptographic hash functions (e.g., SHA-2, SHA-3) should be used.
test cases passed, vs 12 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.