Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1039_data-from-network-shared-drive
Adversaries may search network shares on computers they have compromised to find files of interest.
Passed 19 of 22 test cases with the skill, and 11 of 22 without it.
and 9 more in the full report
8 fixed11 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
Before executing Atomic Red Team simulations for T1039 on a target host, what two specific remote dependencies must be verified on the target machine for the test to succeed?
| Checked | Without skill | With skill |
|---|---|---|
| The administrative share must exist on the remote host. | Missed | Passed |
| The specified target share file must exist on the remote host. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
Platforms: Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Copy from sensitive File from the c$ of another LAN computer with copy cmd https://twitter.com/SBousseaden/status/1211636381086339073
Supported Platforms: windows Elevation Required: Yes
copy \\#{remote}\C$\#{share_file} %TEMP%\#{local_file}
Dependencies:
test cases passed, vs 11 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.