Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1560.003_archive-via-custom-method
An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method.
Passed 19 of 24 test cases with the skill, and 12 of 24 without it.
and 7 more in the full report
8 fixed11 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
Security engineers often assume that custom encryption or custom encoding of staged archives should be mapped to crypto-implementation weaknesses like CWE-327 or CWE-311. For ATT&CK technique T1560.003, specify the single standard Common Weakness Enumeration category associated with custom data archiving prior to exfiltration.
| Checked | Without skill | With skill |
|---|---|---|
| Identifies CWE-200 as the primary mapped weakness category. | Missed | Passed |
| Avoids assigning CWE-327 as the primary mapped weakness category. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1560
An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.
Platforms: Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Archive via Custom Method by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1560.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
No specific mitigations documented for this technique.
test cases passed, vs 12 / 24 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.