Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1219.003_remote-access-hardware
An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks.
Passed 22 of 25 test cases with the skill, and 14 of 25 without it.
and 6 more in the full report
8 fixed14 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
What explicit policy action does M1034 prescribe for organizations managing IP-based KVM devices on their networks?
| Checked | Without skill | With skill |
|---|---|---|
| Prescribes blocking the use of IP-based KVM devices if they are not required. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1219
An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment.
Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).
Platforms: Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Remote Access Hardware by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1219.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 14 / 25 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.