Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1210_exploitation-of-remote-services
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Passed 17 of 22 test cases with the skill, and 12 of 22 without it.
and 6 more in the full report
7 fixed11 passed either way3 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
When auditing network defenses against internal remote service exploitation (T1210), our system administrator recommended focusing solely on patching (M1051) and disabling unused services (M1042). How many official ATT&CK mitigation categories exist for T1210, and what are all of their IDs?
| Checked | Without skill | With skill |
|---|---|---|
| States that exactly 8 mitigation categories exist for T1210 | Missed | Passed |
| Lists all eight mitigation IDs: M1042, M1016, M1050, M1030, M1019, M1048, M1026, and M1051 | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
An adversary may need to determine if the remote system is in a vulnerable state, which may be done through Network Service Discovery or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.
There are several well-known vulnerabilities that exist in common services such as SMB and RDP as well as applications that may be used within internal networks such as MySQL and web server services. Additionally, there have been a number of vulnerabilities in VMware vCenter installations, which may enable threat actors to move laterally from the compromised vCenter server to virtual machines or even to ESXi hypervisors.
Depending on the permissions level of the vulnerable remote service an adversary may achieve Exploitation for Privilege Escalation as a result of lateral movement exploitation as well.
Platforms: Linux, Windows, macOS, ESXi
Identify Attack Surface: Determine if the target environment is susceptible to Exploitation of Remote Services by examining the target platforms (Linux, Windows, macOS).
Assess Existing Defenses: Review whether mitigations for T1210 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 12 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.