Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1604_proxy-through-victim
Adversaries may use a compromised device as a proxy server to the Internet.
Passed 20 of 23 test cases with the skill, and 11 of 23 without it.
and 9 more in the full report
9 fixed11 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
What exact MITRE ATT&CK Mobile technique ID designates Proxy Through Victim?
| Checked | Without skill | With skill |
|---|---|---|
| Designates the technique ID as T1604. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may use a compromised device as a proxy server to the Internet. By utilizing a proxy, adversaries hide the true IP address of their C2 server and associated infrastructure from the destination of the network traffic. This masquerades an adversary’s traffic as legitimate traffic originating from the compromised device, which can evade IP-based restrictions and alerts on certain services, such as bank accounts and social media websites.
The most common type of proxy is a SOCKS proxy. It can typically be implemented using standard OS-level APIs and 3rd party libraries with no indication to the user. On Android, adversaries can use the Proxy API to programmatically establish a SOCKS proxy connection, or lower-level APIs to interact directly with raw sockets.
Platforms: Android
Determine if the target mobile environment is susceptible to Proxy Through Victim by examining the target platforms (Android).
Review whether mitigations for T1604 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
No specific mitigations documented for this technique.
test cases passed, vs 11 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.