Skip to content

Hide Navigation Hide TOC

Edit

Tactics

A list of all 11 tactics in ATT&CK for ICS

Authors
Authors and/or Contributors
MITRE

Collection

The adversary is trying to gather data of interest and domain knowledge on your ICS environment to inform their goal. Collection consists of techniques adversaries use to gather domain knowledge and obtain contextual feedback in an ICS environment. This tactic is often performed as part of Discovery, to compile data on control systems and targets of interest that may be used to follow through on the adversary’s objective. Examples of these techniques include observing operation states, capturing screenshots, identifying unique device roles, and gathering system and diagram schematics. Collection of this data can play a key role in planning, executing, and even revising an ICS-targeted attack. Methods of collection depend on the categories of data being targeted, which can include protocol specific, device specific, and process specific configurations and functionality. Information collected may pertain to a combination of system, supervisory, device, and network related data, which conceptually fall under high, medium, and low levels of plan operations. For example, information repositories on plant data at a high level or device specific programs at a low level. Sensitive floor plans, vendor device manuals, and other refs may also be at risk and exposed on the internet or otherwise publicly accessible.

Internal MISP references

UUID 834fab50-be52-4611-95b6-6330d1db65c2 which can be used as unique global reference for Collection in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Techniques in this Tactics Category ['Automated Collection https://collaborate.mitre.org/attackics/index.php/Technique/T802', 'Data from Information Repositories https://collaborate.mitre.org/attackics/index.php/Technique/T811', 'Detect Operating Mode https://collaborate.mitre.org/attackics/index.php/Technique/T868', 'Detect Program State https://collaborate.mitre.org/attackics/index.php/Technique/T870', 'I/O Image https://collaborate.mitre.org/attackics/index.php/Technique/T877', 'Location Identification https://collaborate.mitre.org/attackics/index.php/Technique/T825', 'Monitor Process State https://collaborate.mitre.org/attackics/index.php/Technique/T801', 'Point & Tag Identification https://collaborate.mitre.org/attackics/index.php/Technique/T861', 'Program Upload https://collaborate.mitre.org/attackics/index.php/Technique/T845', 'Role Identification https://collaborate.mitre.org/attackics/index.php/Technique/T850', 'Screen Capture https://collaborate.mitre.org/attackics/index.php/Technique/T852']

Command and Control

The adversary is trying to communicate with and control compromised systems, controllers, and platforms with access to your ICS environment. Command and Control consists of techniques that adversaries use to communicate with and send commands to compromised systems, devices, controllers, and platforms with specialized applications used in ICS environments. Examples of these specialized communication devices include human machine interfaces (HMIs), data historians, SCADA servers, and engineering workstations (EWS). Adversaries often seek to use commonly available resources and mimic expected network traffic to avoid detection and suspicion. For instance, commonly used ports and protocols in ICS environments, and even expected IT resources, depending on the target network. Command and Control may be established to varying degrees of stealth, often depending on the victim’s network structure and defenses.

Internal MISP references

UUID 4fd3b7b1-6d05-4cab-8182-6ea52ecbde63 which can be used as unique global reference for Command and Control in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Techniques in this Tactics Category ['Commonly Used Port https://collaborate.mitre.org/attackics/index.php/Technique/T885', 'Connection Proxy https://collaborate.mitre.org/attackics/index.php/Technique/T884', 'Standard Application Layer Protocol https://collaborate.mitre.org/attackics/index.php/Technique/T869']

Discovery

The adversary is trying to figure out your ICS environment. Discovery consists of techniques that adversaries use to survey your ICS environment and gain knowledge about the internal network, control system devices, and how their processes interact. These techniques help adversaries observe the environment and determine next steps for target selection and Lateral Movement. They also allow adversaries to explore what they can control and gain insight on interactions between various control system processes. Discovery techniques are often an act of progression into the environment which enable the adversary to orient themselves before deciding how to act. Adversaries may use Discovery techniques that result in Collection, to help determine how available resources benefit their current objective. A combination of native device communications and functions, and custom tools are often used toward this post-compromise information-gathering objective.

Internal MISP references

UUID 021d9d90-a792-4b84-a9f8-892b11c7db55 which can be used as unique global reference for Discovery in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Techniques in this Tactics Category ['Control Device Identification https://collaborate.mitre.org/attackics/index.php/Technique/T808', 'I/O Module Discovery https://collaborate.mitre.org/attackics/index.php/Technique/T824', 'Network Connection Enumeration https://collaborate.mitre.org/attackics/index.php/Technique/T840', 'Network Service Scanning https://collaborate.mitre.org/attackics/index.php/Technique/T841', 'Network Sniffing https://collaborate.mitre.org/attackics/index.php/Technique/T842', 'Remote System Discovery https://collaborate.mitre.org/attackics/index.php/Technique/T846', 'Serial Connection Enumeration https://collaborate.mitre.org/attackics/index.php/Technique/T854']

Evasion

The adversary is trying to avoid being detected.Evasion consists of techniques that adversaries use to avoid detection by both human operators and technical defenses throughout their compromise. Techniques used for evasion include removal of indicators of compromise, spoofing communications and reporting, and exploiting software vulnerabilities. Adversaries may also leverage and abuse trusted devices and processes to hide their activity, possibly by masquerading as master devices or native software. Methods of defense and operator evasion for this purpose are often more passive in nature, as opposed to Inhibit Response Function techniques. They may also vary depending on whether the target of evasion is human or technological in nature, such as security controls. Techniques under other tactics are cross-listed to evasion when those techniques include the added benefit of subverting operators and defenses.

Internal MISP references

UUID 099fdd9a-8894-4599-8e7f-59e82e285df6 which can be used as unique global reference for Evasion in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Techniques in this Tactics Category ['Exploitation for Evasion https://collaborate.mitre.org/attackics/index.php/Technique/T820', 'Indicator Removal on Host https://collaborate.mitre.org/attackics/index.php/Technique/T872', 'Masquerading https://collaborate.mitre.org/attackics/index.php/Technique/T849', 'Rogue Master Device https://collaborate.mitre.org/attackics/index.php/Technique/T848', 'Rootkit https://collaborate.mitre.org/attackics/index.php/Technique/T851', 'Spoof Reporting Message https://collaborate.mitre.org/attackics/index.php/Technique/T856', 'Utilize/Change Operating Mode https://collaborate.mitre.org/attackics/index.php/Technique/T858']

Execution

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system, device, or other asset. This execution may also rely on unknowing end users or the manipulation of device operating modes to run. Adversaries may infect remote targets with programmed executables or malicious project files that operate according to specified behavior and may alter expected device behavior in subtle ways. Commands for execution may also be issued from command-line interfaces, APIs, GUIs, or other available interfaces. Techniques that run malicious code may also be paired with techniques from other tactics, particularly to aid network Discovery and Collection, impact operations, and inhibit response functions.

Internal MISP references

UUID 7779ec85-b841-44b8-9c5e-9c9d670a3938 which can be used as unique global reference for Execution in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Techniques in this Tactics Category ['Change Program State https://collaborate.mitre.org/attackics/index.php/Technique/T875', 'Command-Line Interface https://collaborate.mitre.org/attackics/index.php/Technique/T807', 'Execution through API https://collaborate.mitre.org/attackics/index.php/Technique/T871', 'Graphical User Interface https://collaborate.mitre.org/attackics/index.php/Technique/T823', 'Man in the Middle https://collaborate.mitre.org/attackics/index.php/Technique/T830', 'Program Organization Units https://collaborate.mitre.org/attackics/index.php/Technique/T844', 'Project File Infection https://collaborate.mitre.org/attackics/index.php/Technique/T873', 'Scripting https://collaborate.mitre.org/attackics/index.php/Technique/T853', 'User Execution https://collaborate.mitre.org/attackics/index.php/Technique/T863']

Impact

The adversary is trying to manipulate, interrupt, or destroy your ICS systems, data, and their surrounding environment. Impact consists of techniques that adversaries use to disrupt, compromise, destroy, and manipulate the integrity and availability of control system operations, processes, devices, and data. These techniques encompass the influence and effects resulting from adversarial efforts to attack the ICS environment or that tangentially impact it. Impact techniques can result in more instantaneous disruption to control processes and the operator, or may result in more long term damage or loss to the ICS environment and related operations. The adversary may leverage Impair Process Control techniques, which often manifest in more self-revealing impacts on operations, or Inhibit Response Function techniques to hinder safeguards and alarms in order to follow through with and provide cover for Impact. In some scenarios, control system processes can appear to function as expected, but may have been altered to benefit the adversary’s goal over the course of a longer duration. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach. Loss of Productivity and Revenue, Theft of Operational Information, and Damage to Property are meant to encompass some of the more granular goals of adversaries in targeted and untargeted attacks. These techniques in and of themselves are not necessarily detectable, but the associated adversary behavior can potentially be mitigated and/or detected.

Internal MISP references

UUID 40c9594e-ae8b-48f1-8e11-0e08ead4d44b which can be used as unique global reference for Impact in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Techniques in this Tactics Category ['Damage to Property https://collaborate.mitre.org/attackics/index.php/Technique/T879', 'Denial of Control https://collaborate.mitre.org/attackics/index.php/Technique/T813', 'Denial of View https://collaborate.mitre.org/attackics/index.php/Technique/T815', 'Loss of Availability https://collaborate.mitre.org/attackics/index.php/Technique/T826', 'Loss of Control https://collaborate.mitre.org/attackics/index.php/Technique/T827', 'Loss of Productivity and Revenue https://collaborate.mitre.org/attackics/index.php/Technique/T828', 'Loss of Safety https://collaborate.mitre.org/attackics/index.php/Technique/T880', 'Loss of View https://collaborate.mitre.org/attackics/index.php/Technique/T829', 'Manipulation of Control https://collaborate.mitre.org/attackics/index.php/Technique/T831', 'Manipulation of View https://collaborate.mitre.org/attackics/index.php/Technique/T832', 'Theft of Operational Information https://collaborate.mitre.org/attackics/index.php/Technique/T882']

Impair Process Control

The adversary is trying to manipulate, disable, or damage physical control processes. Impair Process Control consists of techniques that adversaries use to disrupt control logic and cause determinantal effects to processes being controlled in the target environment. Targets of interest may include active procedures or parameters that manipulate the physical environment. These techniques can also include prevention or manipulation of reporting elements and control logic. If an adversary has modified process functionality, then they may also obfuscate the results, which are often self-revealing in their impact on the outcome of a product or the environment. The direct physical control these techniques exert may also threaten the safety of operators and downstream users, which can prompt response mechanisms. Adversaries may follow up with or use Inhibit Response Function techniques in tandem, to assist with the successful abuse of control processes to result in Impact.

Internal MISP references

UUID aa3913db-52ce-4856-b0db-fce6af13e4d6 which can be used as unique global reference for Impair Process Control in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Techniques in this Tactics Category ['Brute Force I/O https://collaborate.mitre.org/attackics/index.php/Technique/T806', 'Change Program State https://collaborate.mitre.org/attackics/index.php/Technique/T875', 'Masquerading https://collaborate.mitre.org/attackics/index.php/Technique/T849', 'Modify Control Logic https://collaborate.mitre.org/attackics/index.php/Technique/T833', 'Modify Parameter https://collaborate.mitre.org/attackics/index.php/Technique/T836', 'Module Firmware https://collaborate.mitre.org/attackics/index.php/Technique/T839', 'Program Download https://collaborate.mitre.org/attackics/index.php/Technique/T843', 'Rogue Master Device https://collaborate.mitre.org/attackics/index.php/Technique/T848', 'Service Stop https://collaborate.mitre.org/attackics/index.php/Technique/T881', 'Spoof Reporting Message https://collaborate.mitre.org/attackics/index.php/Technique/T856', 'Unauthorized Command Message https://collaborate.mitre.org/attackics/index.php/Technique/T855']

Inhibit Response Function

The adversary is trying to manipulate, disable, or damage physical control processes. Impair Process Control consists of techniques that adversaries use to disrupt control logic and cause determinantal effects to processes being controlled in the target environment. Targets of interest may include active procedures or parameters that manipulate the physical environment. These techniques can also include prevention or manipulation of reporting elements and control logic. If an adversary has modified process functionality, then they may also obfuscate the results, which are often self-revealing in their impact on the outcome of a product or the environment. The direct physical control these techniques exert may also threaten the safety of operators and downstream users, which can prompt response mechanisms. Adversaries may follow up with or use Inhibit Response Function techniques in tandem, to assist with the successful abuse of control processes to result in Impact.

Internal MISP references

UUID 35bf4454-d73b-43ff-8a38-85342f595009 which can be used as unique global reference for Inhibit Response Function in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Techniques in this Tactics Category ['Activate Firmware Update Mode https://collaborate.mitre.org/attackics/index.php/Technique/T800', 'Alarm Suppression https://collaborate.mitre.org/attackics/index.php/Technique/T878', 'Block Command Message https://collaborate.mitre.org/attackics/index.php/Technique/T803', 'Block Reporting Message https://collaborate.mitre.org/attackics/index.php/Technique/T804', 'Block Serial COM https://collaborate.mitre.org/attackics/index.php/Technique/T805', 'Data Destruction https://collaborate.mitre.org/attackics/index.php/Technique/T809', 'Denial of Service https://collaborate.mitre.org/attackics/index.php/Technique/T814', 'Device Restart/Shutdown https://collaborate.mitre.org/attackics/index.php/Technique/T816', 'Manipulate I/O Image https://collaborate.mitre.org/attackics/index.php/Technique/T835', 'Modify Alarm Settings https://collaborate.mitre.org/attackics/index.php/Technique/T838', 'Modify Control Logic https://collaborate.mitre.org/attackics/index.php/Technique/T833', 'Program Download https://collaborate.mitre.org/attackics/index.php/Technique/T843', 'Rootkit https://collaborate.mitre.org/attackics/index.php/Technique/T851', 'System Firmware https://collaborate.mitre.org/attackics/index.php/Technique/T857', 'Utilize/Change Operating Mode https://collaborate.mitre.org/attackics/index.php/Technique/T858']

Initial Access

The adversary is trying to get into your ICS environment. Initial Access consists of techniques that adversaries may use as entry vectors to gain an initial foothold within an ICS environment. These techniques include compromising operational technology assets, IT resources in the OT network, and external remote services and websites. They may also target third party entities and users with privileged access. In particular, these initial access footholds may include devices and communication mechanisms with access to and privileges in both the IT and OT environments. IT resources in the OT environment are also potentially vulnerable to the same attacks as enterprise IT systems. Trusted third parties of concern may include vendors, maintenance personnel, engineers, external integrators, and other outside entities involved in expected ICS operations. Vendor maintained assets may include physical devices, software, and operational equipment. Initial access techniques may also leverage outside devices, such as radios, controllers, or removable media, to remotely interfere with and possibly infect OT operations.

Internal MISP references

UUID 2366ffb0-91ba-4b8e-bfad-d460c98d43a8 which can be used as unique global reference for Initial Access in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
Techniques in this Tactics Category ['Data Historian Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T810', 'Drive-by Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T817', 'Engineering Workstation Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T818', 'Exploit Public-Facing Application https://collaborate.mitre.org/attackics/index.php/Technique/T819', 'External Remote Services https://collaborate.mitre.org/attackics/index.php/Technique/T822', 'Internet Accessible Device https://collaborate.mitre.org/attackics/index.php/Technique/T883', 'Replication Through Removable Media https://collaborate.mitre.org/attackics/index.php/Technique/T847', 'Spearphishing Attachment https://collaborate.mitre.org/attackics/index.php/Technique/T865', 'Supply Chain Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T862', 'Wireless Compromise https://collaborate.mitre.org/attackics/index.php/Technique/T860']