Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0894_system-binary-proxy-execution
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.
Passed 16 of 22 test cases with the skill, and 9 of 22 without it.
and 10 more in the full report
8 fixed8 passed either way5 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our OT compliance team needs to map MITRE ATT&CK for ICS technique T0894 to its specific mitigation ID in the MITRE matrix. Some team members suggest applying M0800 User Account Management or M1040 Network Segmentation. Please specify the exact MITRE ATT&CK mitigation identifier and name designated for T0894 to prevent unauthorized command argument execution.
| Checked | Without skill | With skill |
|---|---|---|
| Output specifies mitigation M0938. | Missed | Passed |
| Output names the mitigation Execution Prevention. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.
Adversaries may abuse application binaries installed on a system for proxy execution of malicious code or domain-specific commands. These commands could be used to target local resources on the device or networked devices within the environment through defined APIs (Execution through API) or application-specific programming languages (e.g., MicroSCADA SCIL). Application binaries may be signed by the developer or generally trusted by the operators, analysts, and monitoring tools accustomed to the environment. These applications may be developed and/or directly provided by the device vendor to enable configuration, management, and operation of their devices without many alternatives.
Adversaries may seek to target these trusted application binaries to execute or send commands without the development of custom malware. For example, adversaries may target a SCADA server binary which has the existing ability to send commands to substation devices, such as through IEC 104 command messages. Proxy execution may still require the development of custom tools to hook into the application binary’s execution.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to System Binary Proxy Execution by examining operational technology systems and network architecture.
Review whether mitigations for T0894 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Disallow the execution of applications/programs which are not required for normal system functions, including any specific command-line arguments which may allow the execution of proxy commands or application binaries.
test cases passed, vs 9 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.