Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1027.010_command-obfuscation
Adversaries may obfuscate content during command execution to impede detection.
Passed 18 of 22 test cases with the skill, and 17 of 22 without it.
2 fixed16 passed either way3 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
How many distinct MITRE ATT&CK mitigation entries are listed for sub-technique T1027.010?
| Checked | Without skill | With skill |
|---|---|---|
| States that exactly two mitigations are defined. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1027
Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., Phishing and Drive-by Compromise) or interactively via Command and Scripting Interpreter.
For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, ^, +. $, and %) to make commands difficult to analyze while maintaining the same intended functionality. Many languages support built-in obfuscation in the form of base64 or URL encoding. Adversaries may also manually implement command obfuscation via string splitting (“Wor”+“d.Application”), order and casing of characters (rev <<<'dwssap/cte/ tac'), globing (mkdir -p '/tmp/:&$NiA'), as well as various tricks involving passing strings through tokens/environment variables/input streams.
Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete).
Tools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.
Platforms: Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Command Obfuscation by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1027.010 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 17 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.