Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1659_content-injection
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.
Passed 18 of 23 test cases with the skill, and 6 of 23 without it.
and 17 more in the full report
13 fixed5 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 13 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are designing network security controls to prevent compromised upstream data-transfer channels from injecting untrusted executables into user sessions. What specific action does MITRE mitigation M1021 recommend?
| Checked | Without skill | With skill |
|---|---|---|
| Recommends blocking or restricting the download and execution of uncommon file types. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., Drive-by Target followed by Drive-by Compromise), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., Ingress Tool Transfer) and other data to already compromised systems.
Adversaries may inject content to victim systems in various ways, including:
Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with "lawful interception."
Platforms: Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Start mitmdump and verify injected header and HTML content.
Supported Platforms: macos, linux
test cases passed, vs 6 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.