ICS-OT Cyber Attack Tactics, Techniques & Procedures MITRE

Understand drive-by compromise and watering hole attacks that infect visitors via compromised sites. Learn mitigations like browser sandboxing, exploit protection, network segmentation, and log-based detection.

Exploiting public facing applications enables initial access by targeting internet-exposed services; attackers use Shodan and Google dorking to identify vulnerabilities, while mitigations include sandboxing, least privilege, and monitoring.

Exploit remote services like rdp, smb, ssh, and vnc to infiltrate OT networks. Segment networks, use mfa, restrict rdp/vnc to read-only on hmi, and monitor logon anomalies and traffic.

Replication through removable media lets attackers breach air gapped ICS environments via USB drives, compromising Mis, PLCs, and workstations; monitor drive creation, file access, and execution with defense in depth.

Supply chain compromise enables adversaries to tamper with products, software, or delivery mechanisms before end users, including counterfeit hardware and trojanized ICS software, in OT environments.

Explore how adversaries exploit wireless protocols like Wi-Fi, Bluetooth, and GPS to gain unauthorized access, and learn mitigations such as encryption, mutual authentication, and RF shielding in ICS.

Explore how native API exploitation grants direct access to the os kernel in industrial control systems, illustrate Triton's kernel-level abuse, and outline hardening steps to defend ICS.

Learn how user interaction enables malicious code execution, from opening attachments and enabling macros to granting permissions. The module covers spearphishing, installer delivery, and backdoor execution driven by users.

Project file infection hijacks industrial processes by embedding malicious code into PLC project files, creating long-term persistence; defend with auditing, code signing, restricting permissions, and encryption, as shown by Stuxnet.

Explore system firmware as the hidden brain powering devices, and learn how to defend it with three pillars: verify code, control access, and secure update networks.

Valid accounts let attackers bypass defenses with stolen or default credentials, enabling persistence and lateral movement into industrial control systems; MFA, least privilege, and threat hunting help detect impostors.

Explore privilege escalation in ot security, turning a guest pass into a master key to control physical systems. Mitre attack tracks many techniques for industrial control systems.

Explore evasion tactics in industrial control systems by adversaries who hide in plain sight, abusing trusted elements, spoofing communications, and removing indicators of compromise to defeat defenses.

Explore discovery tactics where adversaries survey your environment to identify targets, learn network architecture and communications, and plan lateral movement, using techniques like network enumeration and sniffing.

Learn how attackers perform network connection enumeration to gather information from active connections and map device roles. Explore DNS, LDAP, SNMP, and netstat-based techniques to identify shares, subnets, and patterns.

Explore remote system discovery as a lateral movement technique, showing how attackers enumerate devices by ip address, hostname, or other identifiers using built-in tools or windows networking (wnet).

Learn how adversaries perform remote system information discovery to collect hardware, software, OS details, and system roles for planning and targeting subsequent attacks.

Examine wireless sniffing across Bluetooth, Wi-Fi, infrared, and RF links, including industrial and enterprise contexts, and learn practical defenses like encrypted protocols, WPA, two-factor, and radius authentication.

Examine how default credentials enable lateral movement in control systems, stressing changing admin passwords after first boot to prevent exploitation, with Stuxnet's use of hardcoded defaults as context.

Explains lateral transfer of tools and files between endpoints using smb, vbscript, and sql statements, with Stuxnet as an example.

Detect operating mode explains how attackers observe whether a controller is in program, run, remote, stop, reset, or test mode to plan actions and program downloads.

Examine man in the middle attacks in the MITRE framework, where privileged adversaries intercept, block, log, modify, or inject traffic and redirect it to a local service.

Monitor the process state and gather information from OPC data, historian records, PLC blocks, and valve status to inform attacks and potentially alter process parameters.

Explore point and tag identification in Mitre's framework, showing how adversaries collect inputs, memory, locations, and tag names to map industrial processes and enumerate OPC tags.

Explain how adversaries may upload a PLC program to read and study the running logic using vendor software, and stress securing backups and controlling uploads.

Screen capture techniques collect screenshots from HMI or workstation displays to reveal operator behavior and typical commands. Adversaries may use this to mimic operations and remain undetected on the network.

Explore commonly used ports and protocols, how attackers bypass firewalls by blending with normal traffic, and how deep packet inspection and application layer firewalls help detect Stuxnet's UDP 1502 usage.

Adversaries exploit the standard application layer protocol to establish command and control using public protocols like HTTP, sometimes on nonstandard ports, including vendor proprietary and industrial protocols.