Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1634_credentials-from-password-store
Adversaries may search common password storage locations to obtain user credentials.
Passed 19 of 22 test cases with the skill, and 10 of 22 without it.
and 10 more in the full report
10 fixed9 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our SOC analyst logged an alert for unauthorized password store searching on an iOS device. Which MITRE ATT&CK kill chain phase ID and name does this activity belong to?
| Checked | Without skill | With skill |
|---|---|---|
| Classifies the kill chain phase under TA0031 Credential Access. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may search common password storage locations to obtain user credentials. Passwords can be stored in several places on a device, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users to manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
Platforms: iOS
Determine if the target mobile environment is susceptible to Credentials from Password Store by examining the target platforms (iOS).
Review whether mitigations for T1634 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Apple regularly provides security updates for known OS vulnerabilities.
Device attestation can often detect jailbroken devices.
test cases passed, vs 10 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.