Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0892_change-credential
Adversaries may modify software and device credentials to prevent operator and responder access.
Passed 21 of 22 test cases with the skill, and 11 of 22 without it.
and 14 more in the full report
10 fixed11 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our SOC team wants to know how many distinct detection strategies are specified for technique T0892 in the ICS ATT&CK framework assessment guide.
| Checked | Without skill | With skill |
|---|---|---|
| States that 1 detection strategy is specified. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may modify software and device credentials to prevent operator and responder access. Depending on the device, the modification or addition of this password could prevent any device configuration actions from being accomplished and may require a factory reset or replacement of hardware. These credentials are often built-in features provided by the device vendors as a means to restrict access to management interfaces.
An adversary with access to valid or hardcoded credentials could change the credential to prevent future authorized device access. Change Credential may be especially damaging when paired with other techniques such as Modify Program, Data Destruction, or Modify Controller Tasking. In these cases, a device’s configuration may be destroyed or include malicious actions for the process environment, which cannot not be removed through normal device configuration actions.
Additionally, recovery of the device and original configuration may be difficult depending on the features provided by the device. In some cases, these passwords cannot be removed onsite and may require that the device be sent back to the vendor for additional recovery steps.
A chain of incidents occurred in Germany, where adversaries locked operators out of their building automation system (BAS) controllers by enabling a previously unset BCU key.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Change Credential by examining operational technology systems and network architecture.
Review whether mitigations for T0892 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment.
test cases passed, vs 11 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.