Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1199_trusted-relationship
Adversaries may breach or otherwise leverage organizations who have access to intended victims.
Passed 19 of 22 test cases with the skill, and 12 of 22 without it.
and 5 more in the full report
8 fixed11 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
What is the exact title of the Common Weakness Enumeration associated with technique T1199?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies Improper Input Validation as the CWE title. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.
In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.
Platforms: Windows, SaaS, IaaS, Linux, macOS, Identity Provider, Office Suite
Identify Attack Surface: Determine if the target environment is susceptible to Trusted Relationship by examining the target platforms (Windows, SaaS, IaaS).
Assess Existing Defenses: Review whether mitigations for T1199 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 12 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.