Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1562.007_disable-or-modify-cloud-firewall
Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.
Passed 20 of 22 test cases with the skill, and 12 of 22 without it.
and 6 more in the full report
8 fixed12 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
What specific MITRE mitigation ID focuses on auditing account role permissions to ensure only authorized entities can alter cloud firewall rules?
| Checked | Without skill | With skill |
|---|---|---|
| The response identifies mitigation M1047. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1562
Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in Disable or Modify System Firewall.
Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allow access into a victim cloud environment and/or move laterally from the cloud control plane to the data plane. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups (or creates new security groups entirely) to allow any TCP/IP connectivity to a cloud-hosted instance. They may also remove networking limitations to support traffic associated with malicious activity (such as cryptomining).
Modifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. It may also be used to open up resources for Brute Force or Endpoint Denial of Service.
Platforms: IaaS
Identify Attack Surface: Determine if the target environment is susceptible to Disable or Modify Cloud Firewall by examining the target platforms (IaaS).
Assess Existing Defenses: Review whether mitigations for T1562.007 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 12 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.