Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1098.005_device-registration
Adversaries may register a device to an adversary-controlled account.
Passed 18 of 21 test cases with the skill, and 14 of 21 without it.
and 3 more in the full report
5 fixed14 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our red team is preparing an automated attack simulation for T1098.005 using Atomic Red Team scripts. What should the lead operator know about existing Atomic Red Team coverage for this specific sub-technique?
| Checked | Without skill | With skill |
|---|---|---|
| States that no Atomic Red Team tests are available for this technique. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1098
Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.
MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network. In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account.
Similarly, an adversary with existing access to a network may register a device or a virtual machine to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.
Devices registered in Entra ID may be able to conduct Internal Spearphishing campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client. Additionally, an adversary may be able to perform a Service Exhaustion Flood on an Entra ID tenant by registering a large number of devices.
Platforms: Windows, Identity Provider
Identify Attack Surface: Determine if the target environment is susceptible to Device Registration by examining the target platforms (Windows, Identity Provider).
Assess Existing Defenses: Review whether mitigations for T1098.005 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 14 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.