Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1564.011_ignore-process-interrupts
Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals.
Passed 19 of 22 test cases with the skill, and 12 of 22 without it.
and 4 more in the full report
7 fixed12 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are compiling detection strategy metrics for T1564.011. How many distinct detection strategies are documented in the technique assessment framework for Ignore Process Interrupts?
| Checked | Without skill | With skill |
|---|---|---|
| Notes that 1 detection strategy is identified for assessing coverage of T1564.011. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1564
Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off. These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes.
Adversaries may invoke processes using nohup, PowerShell -ErrorAction SilentlyContinue, or similar commands that may be immune to hangups. This may enable malicious commands and malware to continue execution through system events that would otherwise terminate its execution, such as users logging off or the termination of its C2 network connection.
Hiding from process interrupt signals may allow malware to continue execution, but unlike Trap this does not establish Persistence since the process will not be re-invoked once actually terminated.
Platforms: Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Ignore Process Interrupts by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1564.011 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 12 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.