Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1200_hardware-additions
Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access.
Passed 20 of 21 test cases with the skill, and 13 of 21 without it.
and 4 more in the full report
7 fixed14 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
In an assessment framework tracking detection coverage metrics for physical attacks, how many distinct detection strategies are defined for MITRE T1200?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies that 1 detection strategy is defined. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.
While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.
Platforms: Windows, Linux, macOS
Identify Attack Surface: Determine if the target environment is susceptible to Hardware Additions by examining the target platforms (Windows, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1200 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Establish network access control policies, such as using device certificates and the 802.1x standard. Restrict use of DHCP to registered devices to prevent unregistered devices from communicating with trusted systems.
test cases passed, vs 13 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.