Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1072_software-deployment-tools
Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network.
Passed 18 of 22 test cases with the skill, and 10 of 22 without it.
and 8 more in the full report
8 fixed10 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are designing network controls between deployment servers and sensitive network segments. Which MITRE mitigation ID mandates network isolation using firewalls for deployment infrastructure?
| Checked | Without skill | With skill |
|---|---|---|
| Cites mitigation M1030 (Network Segmentation). | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.
Access to network-wide or enterprise-wide endpoint management software may enable an adversary to achieve remote code execution on all connected systems. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.
SaaS-based configuration management services may allow for broad Cloud Administration Command on cloud-hosted instances, as well as the execution of arbitrary commands on on-premises endpoints. For example, Microsoft Configuration Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to Entra ID. Such services may also utilize Web Protocols to communicate back to adversary owned infrastructure.
Network infrastructure devices may also have configuration management tools that can be similarly abused by adversaries.
The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to access specific functionality.
Platforms: Linux, macOS, Network Devices, SaaS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
An adversary may use Radmin Viewer Utility to remotely control Windows device, this will start the radmin console.
test cases passed, vs 10 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.