Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc.
SkillScore91Maintained
Automatic
◆Security & AppSec pack
Last verified 8/12/2026
What it changes
Passed 20 of 22 test cases with the skill, and 10 of 22 without it.
Without skill45%
With skill91%
Checks it passed that the model alone missed
Rates severity as Medium.
Assigns a severity rating of Medium.
References mitigation ID M1047 Audit.
and 11 more in the full report
10 fixed10 passed either way2 still failing0 broke
Pass-rate lift
+45 pp
Tokens
-3%
Agent turns
0%
Response time
-34%
Model gemini-3.6-flashMeasured 8/12/2026v120 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 10
Prompt
What is the descriptive title of the CWE classification associated with browser attribute spoofing defense evasion?
What was checked, without and with the skill
Checked
Without skill
With skill
Refers to Protection Mechanism Failure.
Missed
Passed
case-15 · gemini-3.6-flash · 8/12/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md65 linessingle file
T1036.012 Browser Fingerprint
Sub-technique of: T1036
High-Level Description
Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.
Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.
Kill Chain Phase
Defense Evasion (TA0005)
Platforms: Linux, macOS, Windows
What to Check
Identify if Browser Fingerprint technique is applicable to target environment
Check Linux systems for indicators of Browser Fingerprint
Check macOS systems for indicators of Browser Fingerprint
Check Windows systems for indicators of Browser Fingerprint
Verify mitigations are bypassed or absent (1 known mitigations)
Identify Attack Surface: Determine if the target environment is susceptible to Browser Fingerprint by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1036.012 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.