Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1668_exclusive-control
Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing o...
Passed 18 of 22 test cases with the skill, and 8 of 22 without it.
and 8 more in the full report
10 fixed8 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
An incident responder is categorizing post-exploitation behavior where an attacker disables local vulnerable services to block competing actors. Which primary MITRE ATT&CK tactics phase ID applies?
| Checked | Without skill | With skill |
|---|---|---|
| Map the activity to tactic ID TA0003 | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system.
For example, adversaries may patch a vulnerable, compromised system to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services, stripping privileges from accounts, or removing other malware already on the compromised device.
Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of Resource Hijacking, leveraging a compromised device’s full power allows the threat actor to maximize profit.
Platforms: Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Exclusive Control by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1668 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
No specific mitigations documented for this technique.
test cases passed, vs 8 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.