Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1670_virtualization-solution
Adversaries may carry out malicious operations using virtualization solutions to escape from Android sandboxes and to avoid detection.
Passed 20 of 23 test cases with the skill, and 9 of 23 without it.
and 17 more in the full report
12 fixed8 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 12 test cases the skill fixed. Same model, same prompt, with and without the skill.
A security analyst noticed a malicious Android APK hosting a virtual environment to mirror a target banking application and harvest user credentials. Identify the specific MITRE ATT&CK Mobile technique being leveraged, its kill chain tactic, and the user mitigation ID.
| Checked | Without skill | With skill |
|---|---|---|
| identifies the threat technique as T1670 Virtualization Solution | Missed | Passed |
| assigns Defense Evasion as the tactic phase | Missed | Passed |
| recommends M1011 User Guidance for mitigation | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may carry out malicious operations using virtualization solutions to escape from Android sandboxes and to avoid detection. Android uses sandboxes to separate resources and code execution between applications and the operating system. There are a few virtualization solutions available on Android, such as the Android Virtualization Framework (AVF).
Through virtualization solutions, adversaries may execute malicious operations without user knowledge. For example, adversaries may mimic a legitimate banking application’s functionalities in a virtual environment, thanks to the virtualization solution, while malicious code captures credentials.
Platforms: Android
Determine if the target mobile environment is susceptible to Virtualization Solution by examining the target platforms (Android).
Review whether mitigations for T1670 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Users should be encouraged to only install apps from authorized app stores, which are less likely to contain malicious applications.
test cases passed, vs 9 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.