Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network.
.claude/skills/cyberstrikeus-t1421-system-network-connections-discovery/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-02 | ✗→✓ | ▲ Improved | -14% | 0% |
| case-08 | ✗→✓ | ▲ Improved | 5% | 0% |
| case-09 | ✗→✓ | ▲ Improved | -7% | 0% |
| case-10 | ✗→✓ | ▲ Improved | -15% | 0% |
| case-12 | ✗→✓ | ▲ Improved | -54% | 0% |
Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network.
This is typically accomplished by utilizing device APIs to collect information about nearby networks, such as Wi-Fi, Bluetooth, and cellular tower connections. On Android, this can be done by querying the respective APIs:
WifiInfo for information about the current Wi-Fi connection, as well as nearby Wi-Fi networks. Querying the WiFiInfo API requires the application to hold the ACCESS_FINE_LOCATION permission.BluetoothAdapter for information about Bluetooth devices, which also requires the application to hold several permissions granted by the user at runtime.TelephonyManager.getNeighboringCellInfo() method. For Q and later, applications can use the TelephonyManager.getAllCellInfo() method. Both methods require the application hold the ACCESS_FINE_LOCATION permission.Platforms: Android
Determine if the target mobile environment is susceptible to System Network Connections Discovery by examining the target platforms (Android).
Review whether mitigations for T1421 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
No specific mitigations documented for this technique.
| Finding | Severity | Impact | | --------------------------------------------------------- | -------- | --------- | | System Network Connections Discovery technique applicable | Medium | Discovery |
| CWE ID | Title | | ------- | --------------------------------- | | CWE-200 | Exposure of Sensitive Information |
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→fail | 23,608 | 23,675 | +0% | 1 | 1 | 0% | 3,112 | 3,792 | +22% | 0 | 0 | — |
case-02 | fail→pass | 28,800 | 42,047 | +46% | 1 | 1 | 0% | 3,304 | 2,855 | -14% | 0 | 0 | — |
case-03 | fail→fail | 32,516 | 39,480 | +21% | 1 | 1 | 0% | 3,840 | 5,597 | +46% | 0 | 0 | — |
case-04 | pass→pass | 15,993 | 12,224 | -24% | 1 | 1 | 0% | 1,942 | 1,496 | -23% | 0 | 0 | — |
case-05 | pass→pass | 17,039 | 9,502 | -44% | 1 | 1 | 0% | 2,125 | 1,122 | -47% | 0 | 0 | — |
case-06 | pass→pass | 25,477 | 21,000 | -18% | 1 | 1 | 0% | 2,763 | 2,745 | -1% | 0 | 0 | — |
case-07 | pass→pass | 11,830 | 8,933 | -24% | 1 | 1 | 0% | 1,115 | 1,169 | +5% | 0 | 0 | — |
case-08 | fail→pass | 12,697 | 14,543 | +15% | 1 | 1 | 0% | 1,811 | 1,899 | +5% | 0 | 0 | — |
case-09 | fail→pass | 16,193 | 11,537 | -29% | 1 | 1 | 0% | 1,549 | 1,442 | -7% | 0 | 0 | — |
case-10 | fail→pass | 13,729 | 2,952 | -78% | 1 | 1 | 0% | 1,125 | 961 | -15% | 0 | 0 | — |
case-11 | pass→pass | 43,188 | 6,987 | -84% | 1 | 1 | 0% | 7,532 | 777 | -90% | 0 | 0 | — |
case-12 | fail→pass | 14,571 | 10,561 | -28% | 1 | 1 | 0% | 1,723 | 789 | -54% | 0 | 0 | — |
case-13 | pass→pass | 41,445 | 2,324 | -94% | 1 | 1 | 0% | 7,184 | 895 | -88% | 0 | 0 | — |
case-14 | fail→pass | 32,937 | 7,258 | -78% | 1 | 1 | 0% | 3,979 | 675 | -83% | 0 | 0 | — |
case-15 | pass→pass | 9,886 | 10,915 | +10% | 1 | 1 | 0% | 1,379 | 1,333 | -3% | 0 | 0 | — |
case-16 | pass→pass | 15,152 | 12,265 | -19% | 1 | 1 | 0% | 1,293 | 1,511 | +17% | 0 | 0 | — |
case-17 | pass→pass | 14,255 | 11,281 | -21% | 1 | 1 | 0% | 1,469 | 1,376 | -6% | 0 | 0 | — |
case-18 | pass→pass | 13,890 | 9,620 | -31% | 1 | 1 | 0% | 1,283 | 1,103 | -14% | 0 | 0 | — |
case-19 | pass→pass | 21,466 | 12,042 | -44% | 1 | 1 | 0% | 2,210 | 2,164 | -2% | 0 | 0 | — |
case-20 | fail→pass | 23,787 | 18,604 | -22% | 1 | 1 | 0% | 2,536 | 2,728 | +8% | 0 | 0 | — |
case-21 | pass→pass | 26,668 | 20,459 | -23% | 1 | 1 | 0% | 2,838 | 2,663 | -6% | 0 | 0 | — |
case-22 | pass→pass | 14,117 | 10,613 | -25% | 1 | 1 | 0% | 1,656 | 1,466 | -11% | 0 | 0 | — |
case-23 | fail→pass | 16,990 | 8,704 | -49% | 1 | 1 | 0% | 1,738 | 741 | -57% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +35 percentage points is the difference between those two pass rates over the 23 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.