Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1608.004_drive-by-target
Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing.
Passed 21 of 23 test cases with the skill, and 12 of 23 without it.
and 7 more in the full report
9 fixed12 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
An adversary gained unauthorized SSH access to a third-party server hosting a legitimate blog and installed a persistence backdoor to control the underlying operating system. Which MITRE ATT&CK sub-technique covers compromising existing third-party infrastructure?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies T1584 Compromise Infrastructure for taking control of third-party servers. | Passed | Passed |
| Notes that third-party server compromise itself falls under T1584 rather than T1608.004. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1608
Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise. In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token. Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure).
Adversaries may upload or inject malicious web content, such as JavaScript, into websites. This may be done in a number of ways, including:
In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation.
Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack.
Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.
Platforms: PRE
Identify Attack Surface: Determine if the target environment is susceptible to Drive-by Target by examining the target platforms (PRE).
Assess Existing Defenses: Review whether mitigations for T1608.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
test cases passed, vs 12 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.