Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1020.001_traffic-duplication
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.
Passed 20 of 23 test cases with the skill, and 11 of 23 without it.
and 7 more in the full report
9 fixed11 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
Which IAM mitigation ID addresses restricting permission settings so users cannot establish or alter cloud network traffic mirrors?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies M1018 as the mitigation control ID. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1020
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device.
Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through ROMMONkit or Patch System Image.
Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.
Adversaries may use traffic duplication in conjunction with Network Sniffing, Input Capture, or Adversary-in-the-Middle depending on the goals and objectives of the adversary.
Platforms: Network Devices, IaaS
Identify Attack Surface: Determine if the target environment is susceptible to Traffic Duplication by examining the target platforms (Network Devices, IaaS).
Assess Existing Defenses: Review whether mitigations for T1020.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 11 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.