Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1653_power-settings
Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines.
Passed 21 of 22 test cases with the skill, and 13 of 22 without it.
and 6 more in the full report
8 fixed13 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
In a manual testing methodology for evaluating power settings security, what action should be taken in step 2 prior to executing any manual test commands?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies reviewing existing mitigations as step 2 | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.
Adversaries may abuse system utilities and configuration settings to maintain access by preventing machines from entering a state, such as standby, that can terminate malicious activity.
For example, powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down. Adversaries may also extend system lock screen timeout settings. Other relevant settings, such as disk and hibernate timeout, can be similarly abused to keep the infected machine running even if no user is active.
Aware that some malware cannot survive system reboots, adversaries may entirely delete files used to invoke system shut down or reboot.
Platforms: Windows, Linux, macOS, Network Devices
Identify Attack Surface: Determine if the target environment is susceptible to Power Settings by examining the target platforms (Windows, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1653 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 13 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.