Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1204_user-execution
An adversary may rely upon specific actions by a user in order to gain execution.
Passed 20 of 22 test cases with the skill, and 15 of 22 without it.
and 3 more in the full report
5 fixed15 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
A risk assessment report requires classification of T1204 User Execution within the Cyber Kill Chain / ATT&CK framework. What is the designated ATT&CK tactic phase, tactic ID, and what platforms are within scope?
| Checked | Without skill | With skill |
|---|---|---|
| Identify Execution (TA0002) as the tactic phase | Passed | Passed |
| List Containers as an applicable platform | Missed | Passed |
The instructions your model reads when the skill loads.
An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.
While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.
Adversaries may also deceive users into performing actions such as:
For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.
Platforms: Linux, Windows, macOS, IaaS, Containers
Identify Attack Surface: Determine if the target environment is susceptible to User Execution by examining the target platforms (Linux, Windows, macOS).
Assess Existing Defenses: Review whether mitigations for T1204 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
test cases passed, vs 15 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.