Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Adversaries may gain access into industrial environments through systems exposed directly to the internet for remote access rather than through External Remote Services.
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications.
Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend in with normal network activity, to avoid more detailed inspection.
Adversaries may leverage remote services to move between assets and network segments.
Adversaries may seek to capture radio frequency (RF) communication used for remote control and reporting in distributed environments.
An adversary may attempt to get detailed information about remote systems and their peripherals, such as make/model, role, and configuration.
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Adversaries may leverage credentials that are hardcoded in software or firmware to gain an unauthorized interactive user session to an asset.
Adversaries may modify software and device credentials to prevent operator and responder access.
Adversaries may target and collect data from local system sources, such as file systems, configuration files, or local databases.