MITRE ATT&CK for ICS

Tactics represent the high-level technical goals an adversary seeks to achieve during an operation. In the ICS matrix, these are ordered chronologically from initial access to final impact.

• Initial Access: Gaining a foothold in the ICS network via spearphishing, exposed remote services, or compromised engineering workstations.
• Execution: Running malicious code on a controller or HMI, often through native scripting interpreters.
• Persistence: Maintaining long-term access despite reboots or credential changes by modifying firmware or implanting logic bombs.
• Evasion: Avoiding detection by masquerading as legitimate traffic or removing process indicators.
• Inhibit Response Function: Actively disabling safety instrumented systems or alarm management before causing physical damage.
• Impair Process Control: Manipulating setpoints, opening breakers, or issuing unauthorized stop commands to disrupt operations.
• Impact: The final consequence—destroying equipment, violating safety limits, or causing extended downtime.

Techniques describe the specific methods an adversary uses to achieve a tactical objective. Each technique is assigned a unique ID (e.g., T0885) and includes detailed procedural descriptions, mitigation guidance, and detection strategies.

• T0885 - Commonly Used Port: Adversaries communicate over standard ports (e.g., 502 for Modbus, 44818 for EtherNet/IP) to blend in with normal traffic.
• T0878 - Alarm Suppression: Disabling or silencing alarms on the HMI to prevent operators from noticing abnormal process conditions.
• T0831 - Manipulation of Control: Sending unauthorized commands to change controller setpoints, valve positions, or breaker states.
• T0817 - Drive-by Compromise: Infecting an engineering workstation when a user visits a compromised website, establishing a bridge into the air-gapped OT network.

Sub-techniques provide even finer granularity, such as distinguishing between manipulating a single device versus an entire control loop.

Every technique in the ATT&CK for ICS matrix is paired with actionable countermeasures, making it a prescriptive defense tool rather than just a threat catalog.

• M0937 - Network Segmentation: Physically or logically separating IT and OT networks using an Industrial Demilitarized Zone (IDMZ) to prevent lateral movement.
• M0930 - Application Allowlisting: Restricting execution on HMIs and engineering workstations to only authorized, digitally signed binaries.
• M0942 - Encrypt Network Traffic: Deploying VPNs or TLS-wrapped protocols to prevent credential sniffing and command injection.
• Detection Analytics: The framework maps techniques to specific data sources—such as Deep Packet Inspection (DPI) logs, historian data, and asset inventory—that security teams should monitor for anomalous behavior.

ATT&CK for ICS catalogs known adversary groups and the malware tools they deploy, linking each to the specific techniques they have been observed using in the wild.

• APT Groups: Entities like Sandworm (ELECTRUM) and XENOTIME are profiled with their associated campaigns, such as the 2015/2016 Ukraine grid attacks and the TRISIS/TRITON safety system intrusion.
• Software Inventory: Malware families including BlackEnergy 3, INDUSTROYER, and TRITON are documented with their full technique mappings, enabling defenders to understand exactly how each tool operates.
• Campaign Correlation: Analysts can pivot from a detected technique to identify which known groups use it, accelerating attribution and informing threat intelligence briefings.

This structured threat intelligence allows OT security teams to prioritize defenses against the TTPs most relevant to their sector.

MITRE ATT&CK for ICS is designed to complement, not replace, established industrial security standards. It provides the threat-informed bridge between compliance frameworks and operational defense.

• NIST CSF Mapping: Techniques are cross-referenced to the NIST Cybersecurity Framework's Identify, Protect, Detect, Respond, and Recover functions, helping organizations align threat intelligence with governance requirements.
• IEC 62443 Alignment: The framework supports the zone-and-conduit model by identifying which techniques threaten specific levels of the Purdue Model, from Level 0 (physical process) to Level 3/4 (site operations and enterprise).
• Risk Assessment Input: By mapping TTPs to specific system components, ATT&CK provides concrete threat scenarios that enrich traditional HAZOP and LOPA safety analyses.

This interoperability ensures that threat-informed defense enhances, rather than conflicts with, regulatory compliance efforts.