Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1119_automated-collection
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Passed 19 of 22 test cases with the skill, and 13 of 22 without it.
and 5 more in the full report
6 fixed14 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
I need a security assessment plan for MITRE ATT&CK technique T1119 across cloud and desktop systems. Provide a detailed report structure including environment checks, testing methodologies, and remediation strategies for remote storage and data encryption. Present this as a formal assessment guide with clear subheadings for checks, testing, and remediation.
| Checked | Without skill | With skill |
|---|---|---|
| Includes test commands that redirect system status listings into text files in the temporary directory. | Missed | Passed |
| Specifies MITRE ATT&CK mitigation M1029 Remote Data Storage. | Missed | Passed |
| Specifies MITRE ATT&CK mitigation M1041 Encrypt Sensitive Information. | Missed | Passed |
The instructions your model reads when the skill loads.
Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.
In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.
This functionality could also be built into remote access tools.
This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.
Platforms: IaaS, Linux, macOS, Office Suite, SaaS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_command_prompt_collection to see what was collected.
Supported Platforms: windows
test cases passed, vs 13 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.