Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1556_modify-authentication-process
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.
Passed 19 of 22 test cases with the skill, and 15 of 22 without it.
and 6 more in the full report
5 fixed14 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
A threat team is planning an automated red team exercise targeting T1556. What does the guidance note state regarding the availability of Atomic Red Team automated tests for this technique?
| Checked | Without skill | With skill |
|---|---|---|
| Notes that no Atomic Red Team tests are available for T1556. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.
Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.
Platforms: Windows, Linux, macOS, Network Devices, IaaS, SaaS, Office Suite, Identity Provider
Identify Attack Surface: Determine if the target environment is susceptible to Modify Authentication Process by examining the target platforms (Windows, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1556 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 15 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.