Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1059.008_network-device-cli
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
Passed 20 of 23 test cases with the skill, and 12 of 23 without it.
and 5 more in the full report
8 fixed12 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
What impact classification is assigned to the finding when the network device CLI technique is identified as applicable in a target environment?
| Checked | Without skill | With skill |
|---|---|---|
| The response specifies Execution as the impact classification. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1059
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands.
Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or SSH.
Adversaries can use the network CLI to change how network devices behave and operate. The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.
Platforms: Network Devices
Identify Attack Surface: Determine if the target environment is susceptible to Network Device CLI by examining the target platforms (Network Devices).
Assess Existing Defenses: Review whether mitigations for T1059.008 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 12 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.