Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1661_application-versioning
An adversary may push an update to a previously benign application to add malicious code.
Passed 21 of 22 test cases with the skill, and 8 of 22 without it.
and 15 more in the full report
13 fixed8 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 13 test cases the skill fixed. Same model, same prompt, with and without the skill.
How many distinct detection strategies does the ATT&CK Mobile standard outline for T1661 Application Versioning?
| Checked | Without skill | With skill |
|---|---|---|
| States that 1 detection strategy is defined for Application Versioning. | Missed | Passed |
The instructions your model reads when the skill loads.
An adversary may push an update to a previously benign application to add malicious code. This can be accomplished by pushing an initially benign, functional application to a trusted application store, such as the Google Play Store or the Apple App Store. This allows the adversary to establish a trusted userbase that may grant permissions to the application prior to the introduction of malicious code. Then, an application update could be pushed to introduce malicious code.
This technique could also be accomplished by compromising a developer’s account. This would allow an adversary to take advantage of an existing userbase without having to establish the userbase themselves.
Platforms: Android, iOS
Determine if the target mobile environment is susceptible to Application Versioning by examining the target platforms (Android, iOS).
Review whether mitigations for T1661 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Enterprises can provision policies to mobile devices for application allow-listing, ensuring only approved applications are installed onto mobile devices.
test cases passed, vs 8 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.