Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1617_hooking
Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection.
Passed 22 of 24 test cases with the skill, and 13 of 24 without it.
and 8 more in the full report
9 fixed13 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
How many distinct detection strategies and mitigation entries are specified in the standard T1617 assessment protocol for mobile security analysts?
| Checked | Without skill | With skill |
|---|---|---|
| The response states that there are 2 known mitigations for T1617. | Passed | Passed |
| The response states that there is 1 detection strategy for T1617. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection. Hooking can be used to modify return values or data structures of system APIs and function calls. This process typically involves using 3rd party root frameworks, such as Xposed or Magisk, with either a system exploit or pre-existing root access. By including custom modules for root frameworks, adversaries can hook system APIs and alter the return value and/or system data structures to alter functionality/visibility of various aspects of the system.
Platforms: Android
Determine if the target mobile environment is susceptible to Hooking by examining the target platforms (Android).
Review whether mitigations for T1617 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Device attestation can often detect rooted devices.
Mobile security products can often detect rooted devices.
test cases passed, vs 13 / 24 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.