Technique model
ATT&CK for ICS
Adversary behaviour in control systems, translated into what you can observe, where the data comes from, and what to do about it.
An adversary gains access when a user in the environment browses a compromised website.
Observable behaviour
- Browsing activity from hosts that should not browse
- New executables shortly after web traffic
Data sources
- Proxy / DNS logs
- Endpoint process execution
Hunt ideas
- engineering-workstation-compromise
Mitigations
- Remove general browsing from OT hosts
- Application allow-listing
Observed in
- Watering-hole activity reported against energy-sector staff
Adversaries use remote services exposed at the boundary to enter the environment.
Observable behaviour
- Sessions without a named user
- Direct external reachability to control devices
Data sources
- Remote access logs
- Firewall logs
- Identity provider logs
Hunt ideas
- suspicious-remote-access
- unexpected-internet-connectivity
- vendor-account-misuse
Mitigations
- MFA
- Mediated jump-host access
- Default-off vendor accounts
Observed in
- oldsmar
- unitronics-2023
- colonial-pipeline
Malicious code moves between systems on removable media, including across network boundaries.
Observable behaviour
- Device insertion followed by new process execution
Data sources
- Windows PnP events
- Endpoint agent logs
Hunt ideas
- removable-media
Mitigations
- Media control policy with technical enforcement
- Sanitisation kiosks
Observed in
- stuxnet
Adversaries compromise software, hardware or update mechanisms before they reach the environment.
Observable behaviour
- Unexpected behaviour immediately after an update
- Vendor software contacting unusual destinations
Data sources
- Software inventory
- Network metadata
- Vendor advisories
Hunt ideas
- engineering-workstation-compromise
Mitigations
- Validate installation media
- Restrict update paths
- Vendor security requirements in contracts
Observed in
- notpetya
- stuxnet
Adversaries use legitimate credentials, which makes their activity look like normal operations.
Observable behaviour
- Accounts used from hosts they never touch
- Out-of-shift logons
Data sources
- Authentication logs
- Remote access records
Hunt ideas
- abnormal-authentication
- vendor-account-misuse
Mitigations
- Named accounts
- MFA
- Tiered administration
Observed in
- ukraine-2015
Adversaries enumerate devices and services on the control network.
Observable behaviour
- Sequential addressing
- Discovery function bursts
- High connection fan-out
Data sources
- Network metadata
- Firewall denies
- Protocol inspection
Hunt ideas
- ot-network-scanning
Mitigations
- Segmentation limiting reachability
- Passive monitoring for discovery patterns
Observed in
- pipedream
Adversaries capture network traffic to learn the process and protocol details.
Observable behaviour
- Unexpected devices in control VLANs
- Promiscuous or mirrored port changes
Data sources
- Switch configuration changes
- Asset discovery
Hunt ideas
- new-device-control-zone
- unauthorized-wireless
Mitigations
- Port security
- Disable unused ports
- Physical panel security
Adversaries transfer a program to a controller, changing what the controller executes.
Observable behaviour
- Download from a non-engineering host
- Downloads outside change windows
Data sources
- Protocol inspection
- Controller audit logs
- Engineering software logs
Hunt ideas
- unauthorized-plc-programming
- controller-logic-changes
Mitigations
- Restrict programming conduits
- Controller access protection
- Baseline comparison
Observed in
- stuxnet
- triton
- pipedream
Adversaries change controller modes (e.g. into program or stop) to enable modification or halt operation.
Observable behaviour
- Mode transitions without change records
- Stop commands from unexpected hosts
Data sources
- Controller diagnostics
- SCADA status tags
- Protocol inspection
Hunt ideas
- controller-mode-change
- safety-system-anomalies
Mitigations
- Keyswitch discipline
- Mode-change alarming
- Conduit restrictions
Observed in
- triton
Adversaries change setpoints or parameters so the process operates outside intended bounds.
Observable behaviour
- Writes from unexpected clients
- Setpoints outside engineering limits
Data sources
- Protocol inspection
- SCADA operator action logs
- Alarm journals
Hunt ideas
- protocol-write-activity
Mitigations
- Engineering-validated alarm limits
- Read-only conduits where possible
Observed in
- oldsmar
- stuxnet
Adversaries send legitimate-looking protocol commands that were not authorised by an operator.
Observable behaviour
- Commands with no matching operator action
- New master or client peers
Data sources
- Protocol inspection
- Operator action logs
- SCADA event journals
Hunt ideas
- rogue-master-controller
- protocol-write-activity
Mitigations
- Authenticated protocol variants where available
- Strict conduit peer lists
Observed in
- industroyer
- ukraine-2015
Adversaries manipulate physical process control, changing how equipment behaves.
Observable behaviour
- Process values diverging from operator intent
- Control actions with no operator origin
Data sources
- Process historian
- Operator logs
- Protocol inspection
Hunt ideas
- protocol-write-activity
- abnormal-hmi-communication
Mitigations
- Independent process alarms
- Manual operation capability
- Segmentation
Observed in
- oldsmar
- unitronics-2023
Adversaries falsify reported values so operators see a process state that is not real.
Observable behaviour
- Reported values inconsistent with related measurements
- Static values during expected variation
Data sources
- Historian data
- Redundant instrumentation
- Protocol inspection
Hunt ideas
- rogue-master-controller
Mitigations
- Cross-check independent measurements
- Alarm on frozen values
Observed in
- stuxnet
Protection functions are degraded or disabled, removing an independent protection layer.
Observable behaviour
- Safety program or bypass changes
- Safety trips with no process cause
Data sources
- Safety controller logs
- Bypass records
- Change management
Hunt ideas
- safety-system-anomalies
Mitigations
- Independence of the safety layer
- Formal management-of-change
- Change alarming
Observed in
- triton
Operators temporarily lose the ability to send control commands to the process.
Observable behaviour
- Command failures
- Communication loss to controllers
Data sources
- SCADA event logs
- Network metadata
Hunt ideas
- rogue-master-controller
- unexpected-it-to-ot
Mitigations
- Local control fallback
- Redundant communication paths
Observed in
- industroyer
Operators lose visibility of the process while it continues to run.
Observable behaviour
- Display or data collection failures
- Stale values across screens
Data sources
- SCADA logs
- Historian gaps
Hunt ideas
- abnormal-hmi-communication
Mitigations
- Redundant views
- Independent local indication
Observed in
- ukraine-2015
Adversaries restart or shut down devices, disrupting operations or hindering recovery.
Observable behaviour
- Unexpected device reboots
- Clustered device unavailability
Data sources
- Device logs
- Network availability monitoring
Hunt ideas
- controller-mode-change
Mitigations
- Restrict management interfaces
- Alert on unexpected restarts
Observed in
- ukraine-2015
- industroyer
Adversaries modify device firmware, persisting beneath normal recovery activity.
Observable behaviour
- Firmware versions with no work order
- File transfer services used outside maintenance
Data sources
- Firmware inventory
- Vendor tooling reports
- Network metadata
Hunt ideas
- unauthorized-firmware-change
Mitigations
- Signed firmware where supported
- Firmware register and periodic verification
Observed in
- ukraine-2015
Adversaries exploit vulnerable services to move between systems, including across the IT/OT boundary.
Observable behaviour
- Service crashes followed by new processes
- Lateral connections not seen before
Data sources
- Endpoint logs
- Network metadata
- Vulnerability data
Hunt ideas
- unexpected-it-to-ot
Mitigations
- Patch on a defined cadence
- Segmentation to limit reachability
Observed in
- notpetya
- colonial-pipeline
Adversaries copy tools between systems inside the environment.
Observable behaviour
- New executables appearing across multiple hosts
- Admin share usage
Data sources
- Endpoint logs
- File share auditing
Hunt ideas
- engineering-workstation-compromise
Mitigations
- Application allow-listing
- Restrict administrative shares
Observed in
- notpetya
Adversaries collect process and engineering information about the environment.
Observable behaviour
- Bulk queries or archive copies
- Project file collection
Data sources
- Historian query logs
- File access auditing
- Network volume
Hunt ideas
- historian-data-exfiltration
Mitigations
- Least privilege
- Export alerting
- Data classification
Devices reachable directly from the internet give adversaries an unmediated path.
Observable behaviour
- Inbound connections to control ports
- Exposed services in external scan data
Data sources
- Firewall logs
- External attack-surface data
Hunt ideas
- unexpected-internet-connectivity
Mitigations
- Remove exposure
- DMZ termination for all external flows
Observed in
- unitronics-2023
Adversaries relay traffic through intermediary systems to reach the control environment.
Observable behaviour
- Unexpected relay behaviour on a host
- Long-lived outbound sessions
Data sources
- Network metadata
- Proxy logs
Hunt ideas
- unexpected-internet-connectivity
- abnormal-hmi-communication
Mitigations
- Deny-by-default egress
- Session monitoring on jump hosts
Adversaries use legitimate remote services inside the environment to move to other systems.
Observable behaviour
- Interactive sessions between OT hosts not normally connected
Data sources
- Authentication logs
- Session records
- Network metadata
Hunt ideas
- suspicious-remote-access
- abnormal-authentication
Mitigations
- Restrict east/west management protocols
- Jump-host mediation
Observed in
- ukraine-2015
Adversaries blend with normal traffic by using ports and protocols already permitted in the environment.
Observable behaviour
- Permitted ports carrying unexpected payload patterns
- New peers on established services
Data sources
- Protocol inspection
- Network metadata
Hunt ideas
- unexpected-it-to-ot
- time-sync-manipulation
Mitigations
- Protocol-aware inspection at conduits
- Peer allow-lists rather than port-only rules
Targeted email with a malicious attachment provides initial access, usually into the business network first.
Observable behaviour
- Document-spawned process execution
- Macro activity on OT-adjacent hosts
Data sources
- Email security logs
- Endpoint process execution
Hunt ideas
- engineering-workstation-compromise
Mitigations
- No email on OT hosts
- Macro restrictions
- User awareness
Observed in
- ukraine-2015
Laptops and tools that move between environments carry risk across boundaries.
Observable behaviour
- Unmanaged hosts appearing in control zones
- New engineering capability on temporary devices
Data sources
- Asset discovery
- Switch port data
- Work orders
Hunt ideas
- new-engineering-workstation
- new-device-control-zone
Mitigations
- Transient asset policy and scanning
- Dedicated site laptops
Observed in
- stuxnet
Adversaries modify module-level firmware to persist below the controller application.
Observable behaviour
- Module version drift
- Unexplained module resets
Data sources
- Vendor tooling inventory
- Device logs
Hunt ideas
- unauthorized-firmware-change
- controller-logic-changes
Mitigations
- Signed firmware
- Module-level inventory
Adversaries access the environment through wireless connectivity attached to OT systems.
Observable behaviour
- Unapproved wireless devices
- Traffic bypassing wired boundaries
Data sources
- Wireless monitoring
- Asset discovery
- Physical inspection
Hunt ideas
- unauthorized-wireless
Mitigations
- Wireless policy and inventory
- Physical panel inspection
Adversaries collect process or engineering data from historians, file shares and documentation systems.
Observable behaviour
- Bulk repository access
- Unusual accounts browsing engineering shares
Data sources
- Application logs
- File auditing
Hunt ideas
- historian-data-exfiltration
Mitigations
- Least privilege
- Auditing on engineering repositories
Protective functions no longer operate as designed, exposing equipment and people to fault conditions.
Observable behaviour
- Protection setting changes
- Disabled protection elements
Data sources
- Relay settings baselines
- Device logs
Hunt ideas
- unauthorized-firmware-change
- time-sync-manipulation
Mitigations
- Settings baselining
- Change alarms
- Physical security