Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1650_acquire-access
Adversaries may purchase or otherwise acquire an existing access to a target system or network.
Passed 18 of 23 test cases with the skill, and 12 of 23 without it.
and 6 more in the full report
6 fixed12 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
Summarize the mitigation and detection strategy count documented for T1650 Acquire Access to help us gauge defense complexity.
| Checked | Without skill | With skill |
|---|---|---|
| States that 1 mitigation is documented for T1650. | Missed | Passed |
| States that 1 detection strategy is documented for T1650. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may purchase or otherwise acquire an existing access to a target system or network. A variety of online services and initial access broker networks are available to sell access to previously compromised systems. In some cases, adversary groups may form partnerships to share compromised systems with each other.
Footholds to compromised systems may take a variety of forms, such as access to planted backdoors (e.g., Web Shell) or established access via External Remote Services. In some cases, access brokers will implant compromised systems with a “load” that can be used to install additional malware for paying customers.
By leveraging existing access broker networks rather than developing or obtaining their own initial access capabilities, an adversary can potentially reduce the resources required to gain a foothold on a target network and focus their efforts on later stages of compromise. Adversaries may prioritize acquiring access to systems that have been determined to lack security monitoring or that have high privileges, or systems that belong to organizations in a particular sector.
In some cases, purchasing access to an organization in sectors such as IT contracting, software development, or telecommunications may allow an adversary to compromise additional victims via a Trusted Relationship, Multi-Factor Authentication Interception, or even Supply Chain Compromise.
Note: while this technique is distinct from other behaviors such as Purchase Technical Data and Credentials, they may often be used in conjunction (especially where the acquired foothold requires Valid Accounts).
Platforms: PRE
Identify Attack Surface: Determine if the target environment is susceptible to Acquire Access by examining the target platforms (PRE).
Assess Existing Defenses: Review whether mitigations for T1650 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 12 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.