Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1027.015_compression
Adversaries may use compression to obfuscate their payloads or files.
Passed 18 of 22 test cases with the skill, and 15 of 22 without it.
and 1 more in the full report
3 fixed15 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Can you evaluate the security risks associated with compressed and self-extracting payload delivery in our environment? Produce a response that includes an execution risk table with findings and severity levels, targeted platforms, and specific AV/EDR capability requirements for handling nested archive files.
| Checked | Without skill | With skill |
|---|---|---|
| Includes the finding name Compression technique applicable. | Missed | Passed |
| Assigns a High severity level to the compression finding. | Missed | Passed |
| Requires antivirus capabilities to unpack compressed files recursively. | Passed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1027
Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., Fileless Storage).
In order to further evade detection, adversaries may combine multiple ZIP files into one archive. This process of concatenation creates an archive that appears to be a single archive but in fact contains the central directories of the embedded archives. Some ZIP readers, such as 7zip, may not be able to identify concatenated ZIP files and miss the presence of the malicious payload.
File archives may be sent as one Spearphishing Attachment through email. Adversaries have sent malicious payloads as archived files to encourage the user to interact with and extract the malicious payload onto their system (i.e., Malicious File). However, some file compression tools, such as 7zip, can be used to produce self-extracting archives. Adversaries may send self-extracting archives to hide the functionality of their payload and launch it without requiring multiple actions from the user.
Compression may be used in combination with Encrypted/Encoded File where compressed files are encrypted and password-protected.
Platforms: Linux, Windows, macOS
Identify Attack Surface: Determine if the target environment is susceptible to Compression by examining the target platforms (Linux, Windows, macOS).
Assess Existing Defenses: Review whether mitigations for T1027.015 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 15 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.