@cyberstrike-io/cyberstrike 1.1.10-beta.4 → 1.1.10

package/skill/mitre_attack/TA0043_reconnaissance/T1598.001_spearphishing-service/SKILL.md

@@ -73,27 +73,25 @@ All forms of spearphishing are electronically delivered social engineering targe
 ## Remediation Guide
 
 ### M1017 User Training
-Users can be trained to identify social engineering techniques and spearphishing attempts.
 
+Users can be trained to identify social engineering techniques and spearphishing attempts.
 
 ## Detection
 
 ### Detection of Spearphishing Service
 
-
 ## Risk Assessment
 
-| Finding | Severity | Impact |
-| ------- | -------- | ------ |
-| Spearphishing Service technique applicable | High | Reconnaissance |
+| Finding                                    | Severity | Impact         |
+| ------------------------------------------ | -------- | -------------- |
+| Spearphishing Service technique applicable | High     | Reconnaissance |
 
 ## CWE Categories
 
-| CWE ID | Title |
-| ------ | ----- |
+| CWE ID  | Title                             |
+| ------- | --------------------------------- |
 | CWE-200 | Exposure of Sensitive Information |
 
-
 ## References
 
 - [ThreatPost Social Media Phishing](https://threatpost.com/facebook-launching-pad-phishing-attacks/160351/)

package/skill/mitre_attack/TA0043_reconnaissance/T1598.002_spearphishing-attachment/SKILL.md

@@ -75,30 +75,29 @@ Adversaries may also use information from previous reconnaissance efforts (ex: S
 ## Remediation Guide
 
 ### M1017 User Training
+
 Users can be trained to identify social engineering techniques and spearphishing attempts.
 
 ### M1054 Software Configuration
-Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.
 
+Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.
 
 ## Detection
 
 ### Detection of Spearphishing Attachment
 
-
 ## Risk Assessment
 
-| Finding | Severity | Impact |
-| ------- | -------- | ------ |
-| Spearphishing Attachment technique applicable | High | Reconnaissance |
+| Finding                                       | Severity | Impact         |
+| --------------------------------------------- | -------- | -------------- |
+| Spearphishing Attachment technique applicable | High     | Reconnaissance |
 
 ## CWE Categories
 
-| CWE ID | Title |
-| ------ | ----- |
+| CWE ID  | Title                             |
+| ------- | --------------------------------- |
 | CWE-200 | Exposure of Sensitive Information |
 
-
 ## References
 
 - [ACSC Email Spoofing](https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf)

package/skill/mitre_attack/TA0043_reconnaissance/T1598.003_spearphishing-link/SKILL.md

@@ -83,32 +83,31 @@ From the fake website, information is gathered in web forms and sent to the adve
 ## Remediation Guide
 
 ### M1017 User Training
+
 Users can be trained to identify social engineering techniques and spearphishing attempts. Additionally, users may perform visual checks of the domains they visit; however, homographs in ASCII and in IDN domains and URL schema obfuscation may render manual checks difficult. Phishing training and other cybersecurity training may raise awareness to check URLs before visiting the sites.
 
 ### M1054 Software Configuration
+
 Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.
 
 Furthermore, policies may enforce / install browser extensions that protect against IDN and homograph attacks. Browser password managers may also be configured to only populate credential fields when the URL matches that of the original, legitimate site.
 
-
 ## Detection
 
 ### Detection of Spearphishing Link
 
-
 ## Risk Assessment
 
-| Finding | Severity | Impact |
-| ------- | -------- | ------ |
-| Spearphishing Link technique applicable | High | Reconnaissance |
+| Finding                                 | Severity | Impact         |
+| --------------------------------------- | -------- | -------------- |
+| Spearphishing Link technique applicable | High     | Reconnaissance |
 
 ## CWE Categories
 
-| CWE ID | Title |
-| ------ | ----- |
+| CWE ID  | Title                             |
+| ------- | --------------------------------- |
 | CWE-200 | Exposure of Sensitive Information |
 
-
 ## References
 
 - [ACSC Email Spoofing](https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf)

package/skill/mitre_attack/TA0043_reconnaissance/T1598.004_spearphishing-voice/SKILL.md

@@ -77,27 +77,25 @@ Adversaries may also use information from previous reconnaissance efforts (ex: S
 ## Remediation Guide
 
 ### M1017 User Training
-Users can be trained to identify and report social engineering techniques and spearphishing attempts, while also being suspicious of and verifying the identify of callers.
 
+Users can be trained to identify and report social engineering techniques and spearphishing attempts, while also being suspicious of and verifying the identify of callers.
 
 ## Detection
 
 ### Detection of Spearphishing Voice
 
-
 ## Risk Assessment
 
-| Finding | Severity | Impact |
-| ------- | -------- | ------ |
-| Spearphishing Voice technique applicable | High | Reconnaissance |
+| Finding                                  | Severity | Impact         |
+| ---------------------------------------- | -------- | -------------- |
+| Spearphishing Voice technique applicable | High     | Reconnaissance |
 
 ## CWE Categories
 
-| CWE ID | Title |
-| ------ | ----- |
+| CWE ID  | Title                             |
+| ------- | --------------------------------- |
 | CWE-200 | Exposure of Sensitive Information |
 
-
 ## References
 
 - [Avertium callback phishing](https://www.avertium.com/resources/threat-reports/everything-you-need-to-know-about-callback-phishing)

package/skill/mitre_attack/TA0043_reconnaissance/T1598_phishing-for-information/SKILL.md

@@ -26,8 +26,7 @@ chains_with:
   - T1598.002
   - T1598.003
   - T1598.004
-prerequisites:
-  []
+prerequisites: []
 severity_boost:
   T1598.001: "Chain with T1598.001 for deeper attack path"
   T1598.002: "Chain with T1598.002 for deeper attack path"
@@ -44,7 +43,7 @@ All forms of phishing are electronically delivered social engineering. Phishing
 
 Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means. Victims may also receive phishing messages that direct them to call a phone number where the adversary attempts to collect confidential information.
 
-Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools. 
+Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages. Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools.
 
 Phishing for information may also involve evasive techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).
 
@@ -76,30 +75,29 @@ Phishing for information may also involve evasive techniques, such as removing o
 ## Remediation Guide
 
 ### M1017 User Training
+
 Users can be trained to identify social engineering techniques and spearphishing attempts.
 
 ### M1054 Software Configuration
-Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.
 
+Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.
 
 ## Detection
 
 ### Detection of Phishing for Information
 
-
 ## Risk Assessment
 
-| Finding | Severity | Impact |
-| ------- | -------- | ------ |
-| Phishing for Information technique applicable | High | Reconnaissance |
+| Finding                                       | Severity | Impact         |
+| --------------------------------------------- | -------- | -------------- |
+| Phishing for Information technique applicable | High     | Reconnaissance |
 
 ## CWE Categories
 
-| CWE ID | Title |
-| ------ | ----- |
+| CWE ID  | Title                             |
+| ------- | --------------------------------- |
 | CWE-200 | Exposure of Sensitive Information |
 
-
 ## References
 
 - [ACSC Email Spoofing](https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf)

package/skill/mitre_attack/TA0043_reconnaissance/T1681_search-threat-vendor-data/SKILL.md

@@ -21,10 +21,8 @@ tech_stack:
   - pre
 cwe_ids:
   - CWE-200
-chains_with:
-  []
-prerequisites:
-  []
+chains_with: []
+prerequisites: []
 severity_boost: {}
 ---
 
@@ -32,7 +30,7 @@ severity_boost: {}
 
 ## High-Level Description
 
-Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. 
+Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations.
 
 Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation.
 
@@ -66,27 +64,25 @@ This technique is distinct from Threat Intel Vendors in that it describes threat
 ## Remediation Guide
 
 ### M1056 Pre-compromise
-This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on designing defenses that are not reliant on atomic indicators.
 
+This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on designing defenses that are not reliant on atomic indicators.
 
 ## Detection
 
 ### Detection of Search Threat Vendor Data
 
-
 ## Risk Assessment
 
-| Finding | Severity | Impact |
-| ------- | -------- | ------ |
-| Search Threat Vendor Data technique applicable | Low | Reconnaissance |
+| Finding                                        | Severity | Impact         |
+| ---------------------------------------------- | -------- | -------------- |
+| Search Threat Vendor Data technique applicable | Low      | Reconnaissance |
 
 ## CWE Categories
 
-| CWE ID | Title |
-| ------ | ----- |
+| CWE ID  | Title                             |
+| ------- | --------------------------------- |
 | CWE-200 | Exposure of Sensitive Information |
 
-
 ## References
 
 - [Sentinel One Contagious Interview ClickFix September 2025](https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/)

package/skill/mitre_attack_ics/README.md

@@ -35,21 +35,21 @@ mitre_attack_ics/
 
 ## Tactic Breakdown
 
-| Tactic ID | Name | Skills |
-|-----------|------|--------|
-| TA0100 | Collection | 10 |
-| TA0101 | Command and Control | 3 |
-| TA0102 | Discovery | 5 |
-| TA0103 | Evasion | 6 |
-| TA0104 | Execution | 10 |
-| TA0105 | Impact | 12 |
-| TA0106 | Impair Process Control | 3 |
-| TA0107 | Inhibit Response Function | 12 |
-| TA0108 | Initial Access | 12 |
-| TA0109 | Lateral Movement | 4 |
-| TA0110 | Persistence | 5 |
-| TA0111 | Privilege Escalation | 1 |
-| **Total** | | **83** |
+| Tactic ID | Name                      | Skills |
+| --------- | ------------------------- | ------ |
+| TA0100    | Collection                | 10     |
+| TA0101    | Command and Control       | 3      |
+| TA0102    | Discovery                 | 5      |
+| TA0103    | Evasion                   | 6      |
+| TA0104    | Execution                 | 10     |
+| TA0105    | Impact                    | 12     |
+| TA0106    | Impair Process Control    | 3      |
+| TA0107    | Inhibit Response Function | 12     |
+| TA0108    | Initial Access            | 12     |
+| TA0109    | Lateral Movement          | 4      |
+| TA0110    | Persistence               | 5      |
+| TA0111    | Privilege Escalation      | 1      |
+| **Total** |                           | **83** |
 
 ## ICS-Specific Tactics
 
@@ -75,6 +75,7 @@ Some techniques belong to multiple tactics. These are placed in their **primary
 Each SKILL.md contains:
 
 **YAML Frontmatter:**
+
 - `technique_id` — ATT&CK ICS technique ID (T0817, T0826, etc.)
 - `tactic` — Primary tactic (kill chain phase)
 - `all_tactics` — All tactics this technique belongs to
@@ -87,6 +88,7 @@ Each SKILL.md contains:
 - `severity_boost` — Chain severity mapping
 
 **Body Sections:**
+
 - **High-Level Description** — Full technique description
 - **Kill Chain Phase** — Tactic position with IDs
 - **What to Check** — Checklist for ICS assessment

package/skill/mitre_attack_ics/TA0100_collection/T0801_monitor-process-state/SKILL.md

@@ -20,10 +20,8 @@ tech_stack:
   - ics
 cwe_ids:
   - CWE-200
-chains_with:
-  []
-prerequisites:
-  []
+chains_with: []
+prerequisites: []
 severity_boost: {}
 ---
 
@@ -59,27 +57,25 @@ Review whether mitigations for T0801 are in place. If defenses are absent or mis
 ## Remediation Guide
 
 ### M0816 Mitigation Limited or Not Effective
-This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
 
+This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
 
 ## Detection
 
 ### Detection of Monitor Process State
 
-
 ## Risk Assessment
 
-| Finding | Severity | Impact |
-| ------- | -------- | ------ |
-| Monitor Process State technique applicable | Medium | Collection |
+| Finding                                    | Severity | Impact     |
+| ------------------------------------------ | -------- | ---------- |
+| Monitor Process State technique applicable | Medium   | Collection |
 
 ## CWE Categories
 
-| CWE ID | Title |
-| ------ | ----- |
+| CWE ID  | Title                             |
+| ------- | --------------------------------- |
 | CWE-200 | Exposure of Sensitive Information |
 
-
 ## References
 
 - [MITRE ATT&CK ICS - T0801](https://attack.mitre.org/techniques/T0801)

package/skill/mitre_attack_ics/TA0100_collection/T0802_automated-collection/SKILL.md

@@ -20,10 +20,8 @@ tech_stack:
   - ics
 cwe_ids:
   - CWE-200
-chains_with:
-  []
-prerequisites:
-  []
+chains_with: []
+prerequisites: []
 severity_boost: {}
 ---
 
@@ -59,30 +57,29 @@ Review whether mitigations for T0802 are in place. If defenses are absent or mis
 ## Remediation Guide
 
 ### M0807 Network Allowlists
+
 Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support.
 
 ### M0930 Network Segmentation
-Prevent unauthorized systems from accessing control servers or field devices containing industrial information, especially services used for common automation protocols (e.g., DNP3, OPC).
 
+Prevent unauthorized systems from accessing control servers or field devices containing industrial information, especially services used for common automation protocols (e.g., DNP3, OPC).
 
 ## Detection
 
 ### Detection of Automated Collection
 
-
 ## Risk Assessment
 
-| Finding | Severity | Impact |
-| ------- | -------- | ------ |
-| Automated Collection technique applicable | Low | Collection |
+| Finding                                   | Severity | Impact     |
+| ----------------------------------------- | -------- | ---------- |
+| Automated Collection technique applicable | Low      | Collection |
 
 ## CWE Categories
 
-| CWE ID | Title |
-| ------ | ----- |
+| CWE ID  | Title                             |
+| ------- | --------------------------------- |
 | CWE-200 | Exposure of Sensitive Information |
 
-
 ## References
 
 - [MITRE ATT&CK ICS - T0802](https://attack.mitre.org/techniques/T0802)

package/skill/mitre_attack_ics/TA0100_collection/T0811_data-from-information-repositories/SKILL.md

@@ -20,10 +20,8 @@ tech_stack:
   - ics
 cwe_ids:
   - CWE-200
-chains_with:
-  []
-prerequisites:
-  []
+chains_with: []
+prerequisites: []
 severity_boost: {}
 ---
 
@@ -35,7 +33,7 @@ Adversaries may target and collect data from information repositories. This can
 
 Information collected from these systems may provide the adversary with a better understanding of the operational environment, vendors used, processes, or procedures of the ICS.
 
-In a campaign between 2011 and 2013 against ONG organizations, Chinese state-sponsored actors searched document repositories for specific information such as, system manuals, remote terminal unit (RTU) sites, personnel lists, documents that included the string SCAD*, user credentials, and remote dial-up access information.
+In a campaign between 2011 and 2013 against ONG organizations, Chinese state-sponsored actors searched document repositories for specific information such as, system manuals, remote terminal unit (RTU) sites, personnel lists, documents that included the string SCAD\*, user credentials, and remote dial-up access information.
 
 ## Kill Chain Phase
 
@@ -63,44 +61,47 @@ Review whether mitigations for T0811 are in place. If defenses are absent or mis
 ## Remediation Guide
 
 ### M0947 Audit
+
 Consider periodic reviews of accounts and privileges for critical and sensitive repositories.
 
 ### M0941 Encrypt Sensitive Information
+
 Information which is sensitive to the operation and architecture of the process environment may be encrypted to ensure confidentiality and restrict access to only those who need to know.
 
 ### M0922 Restrict File and Directory Permissions
+
 Protect files with proper permissions to limit opportunities for adversaries to interact and collect information from databases.
 
 ### M0918 User Account Management
+
 Ensure users and user groups have appropriate permissions for their roles through Identity and Access Management (IAM) controls to prevent misuse. Implement user accounts for each individual that may access the repositories for role enforcement and non-repudiation of actions.
 
 ### M0926 Privileged Account Management
+
 Minimize permissions and access for service accounts to limit the information that may be exposed or collected by malicious users or software.
 
 ### M0917 User Training
-Develop and publish policies that define acceptable information to be stored in repositories.
 
+Develop and publish policies that define acceptable information to be stored in repositories.
 
 ## Detection
 
 ### Detection of Data from Information Repositories
 
-
 ## Risk Assessment
 
-| Finding | Severity | Impact |
-| ------- | -------- | ------ |
-| Data from Information Repositories technique applicable | High | Collection |
+| Finding                                                 | Severity | Impact     |
+| ------------------------------------------------------- | -------- | ---------- |
+| Data from Information Repositories technique applicable | High     | Collection |
 
 ## CWE Categories
 
-| CWE ID | Title |
-| ------ | ----- |
+| CWE ID  | Title                             |
+| ------- | --------------------------------- |
 | CWE-200 | Exposure of Sensitive Information |
 
-
 ## References
 
 - [Cybersecurity & Infrastructure Security Agency March 2018](https://us-cert.cisa.gov/ncas/alerts/TA18-074A)
-- [CISA AA21-201A Pipeline Intrusion July 2021](https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf)
+- [CISA AA21-201A Pipeline Intrusion July 2021](<https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf>)
 - [MITRE ATT&CK ICS - T0811](https://attack.mitre.org/techniques/T0811)

package/skill/mitre_attack_ics/TA0100_collection/T0830_adversary-in-the-middle/SKILL.md

@@ -20,10 +20,8 @@ tech_stack:
   - ics
 cwe_ids:
   - CWE-200
-chains_with:
-  []
-prerequisites:
-  []
+chains_with: []
+prerequisites: []
 severity_boost: {}
 ---
 
@@ -31,9 +29,9 @@ severity_boost: {}
 
 ## High-Level Description
 
-Adversaries with privileged network access may seek to modify network traffic in real time using adversary-in-the-middle (AiTM) attacks. This type of attack allows the adversary to intercept traffic to and/or from a particular device on the network. If a AiTM attack is established, then the adversary has the ability to block, log, modify, or inject traffic into the communication stream. There are several ways to accomplish this attack, but some of the most-common are Address Resolution Protocol (ARP) poisoning and the use of a proxy. 
+Adversaries with privileged network access may seek to modify network traffic in real time using adversary-in-the-middle (AiTM) attacks. This type of attack allows the adversary to intercept traffic to and/or from a particular device on the network. If a AiTM attack is established, then the adversary has the ability to block, log, modify, or inject traffic into the communication stream. There are several ways to accomplish this attack, but some of the most-common are Address Resolution Protocol (ARP) poisoning and the use of a proxy.
 
-An AiTM attack may allow an adversary to perform the following attacks: 
+An AiTM attack may allow an adversary to perform the following attacks:
 Block Reporting Message, Spoof Reporting Message, Modify Parameter, Unauthorized Command Message
 
 ## Kill Chain Phase
@@ -62,48 +60,53 @@ Review whether mitigations for T0830 are in place. If defenses are absent or mis
 ## Remediation Guide
 
 ### M0930 Network Segmentation
+
 Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.
 
 ### M0810 Out-of-Band Communications Channel
+
 Utilize out-of-band communication to validate the integrity of data from the primary channel.
 
 ### M0813 Software Process and Device Authentication
+
 To protect against AiTM, authentication mechanisms should not send credentials across the network in plaintext and should also implement mechanisms to prevent replay attacks (such as nonces or timestamps). Challenge-response based authentication techniques that do not directly send credentials over the network provide better protection from AiTM.
 
 ### M0814 Static Network Configuration
+
 Statically defined ARP entries can prevent manipulation and sniffing of switched network traffic, as some AiTM techniques depend on sending spoofed ARP messages to manipulate network host's dynamic ARP tables.
 
 ### M0931 Network Intrusion Prevention
+
 Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level.
 
 ### M0947 Audit
+
 Limit access to network infrastructure and resources that can be used to reshape traffic or otherwise produce AiTM conditions.
 
 ### M0942 Disable or Remove Feature or Program
+
 Disable unnecessary legacy network protocols that may be used for AiTM if applicable.
 
 ### M0802 Communication Authenticity
-Communication authenticity will ensure that any messages tampered with through AiTM can be detected, but cannot prevent eavesdropping on these. In addition, providing communication authenticity around various discovery protocols, such as DNS, can be used to prevent various AiTM procedures.
 
+Communication authenticity will ensure that any messages tampered with through AiTM can be detected, but cannot prevent eavesdropping on these. In addition, providing communication authenticity around various discovery protocols, such as DNS, can be used to prevent various AiTM procedures.
 
 ## Detection
 
 ### Detection of Adversary-in-the-Middle
 
-
 ## Risk Assessment
 
-| Finding | Severity | Impact |
-| ------- | -------- | ------ |
-| Adversary-in-the-Middle technique applicable | High | Collection |
+| Finding                                      | Severity | Impact     |
+| -------------------------------------------- | -------- | ---------- |
+| Adversary-in-the-Middle technique applicable | High     | Collection |
 
 ## CWE Categories
 
-| CWE ID | Title |
-| ------ | ----- |
+| CWE ID  | Title                             |
+| ------- | --------------------------------- |
 | CWE-200 | Exposure of Sensitive Information |
 
-
 ## References
 
 - [Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011](http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258)

package/skill/mitre_attack_ics/TA0100_collection/T0845_program-upload/SKILL.md

@@ -20,10 +20,8 @@ tech_stack:
   - ics
 cwe_ids:
   - CWE-200
-chains_with:
-  []
-prerequisites:
-  []
+chains_with: []
+prerequisites: []
 severity_boost: {}
 ---
 
@@ -59,48 +57,53 @@ Review whether mitigations for T0845 are in place. If defenses are absent or mis
 ## Remediation Guide
 
 ### M0813 Software Process and Device Authentication
+
 Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.
 
 ### M0802 Communication Authenticity
+
 Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.
 
 ### M0800 Authorization Enforcement
+
 All field controllers should restrict program uploads to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.
 
 ### M0801 Access Management
+
 Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.
 
 ### M0930 Network Segmentation
+
 Segment operational network and systems to restrict access to critical system functions to predetermined management systems.
 
 ### M0937 Filter Network Traffic
+
 Filter for protocols and payloads associated with program upload activity to prevent unauthorized access to device configurations.
 
 ### M0807 Network Allowlists
+
 Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.
 
 ### M0804 Human User Authentication
-All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.
 
+All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.
 
 ## Detection
 
 ### Detection of Program Upload
 
-
 ## Risk Assessment
 
-| Finding | Severity | Impact |
-| ------- | -------- | ------ |
-| Program Upload technique applicable | Low | Collection |
+| Finding                             | Severity | Impact     |
+| ----------------------------------- | -------- | ---------- |
+| Program Upload technique applicable | Low      | Collection |
 
 ## CWE Categories
 
-| CWE ID | Title |
-| ------ | ----- |
+| CWE ID  | Title                             |
+| ------- | --------------------------------- |
 | CWE-200 | Exposure of Sensitive Information |
 
-
 ## References
 
 - [MITRE ATT&CK ICS - T0845](https://attack.mitre.org/techniques/T0845)