Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1655.001_match-legitimate-name-or-location
Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them.
Passed 20 of 23 test cases with the skill, and 11 of 23 without it.
and 10 more in the full report
9 fixed11 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
When logging a security audit finding for T1655.001 applicability, what standard finding title should be used in the risk assessment table?
| Checked | Without skill | With skill |
|---|---|---|
| Names the finding as Match Legitimate Name or Location technique applicable. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1655
Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by giving artifacts the name and icon of a legitimate, trusted application (i.e., Settings), or using a package name that matches legitimate, trusted applications (i.e., com.google.android.gm).
Adversaries may also use the same icon of the file or application they are trying to mimic.
Platforms: Android, iOS
Determine if the target mobile environment is susceptible to Match Legitimate Name or Location by examining the target platforms (Android, iOS).
Review whether mitigations for T1655.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Users should be encouraged to only install apps from authorized app stores, which are less likely to contain malicious repackaged apps.
test cases passed, vs 11 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.