Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1059.009_cloud-api
Adversaries may abuse cloud APIs to execute malicious commands.
Passed 22 of 23 test cases with the skill, and 11 of 23 without it.
and 19 more in the full report
11 fixed11 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
During a cloud defense gap analysis, how many documented mitigations exist for sub-technique T1059.009, and what are their official M-identifiers?
| Checked | Without skill | With skill |
|---|---|---|
| The count of known mitigations is specified as 2. | Missed | Passed |
| The mitigations listed include M1038. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1059
Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, PowerShell modules like Azure for PowerShell, or software developer kits (SDKs) available for languages such as Python.
Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies.
With proper permissions (often via use of credentials such as Application Access Token and Web Session Cookie), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.
Platforms: IaaS, Identity Provider, Office Suite, SaaS
Identify Attack Surface: Determine if the target environment is susceptible to Cloud API by examining the target platforms (IaaS, Identity Provider, Office Suite).
Assess Existing Defenses: Review whether mitigations for T1059.009 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 11 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.