Alarm suppression
Alarms disabled or modified so unsafe conditions go unnoticed
categoryWireless, mobile, IoT and OT/ICS attacksseverityVery HighdetectabilityNonelabnot yet measured
Classification
25 values: 14 reviewed, 10 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Wireless, mobile & IoT/OT |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | Medium |
| Resources required | Low |
| Likelihood / prevalence | Medium |
| Maturity | Established |
Impact & scope
| Severity | Very High |
|---|---|
| Impact | IntegritySafety |
| Platform | None |
| Environment | OT / ICS |
| Target asset class | PhysicalServer |
| Kill-chain phase (tactic) | Inhibit Response Function (ICS) |
Detection & telemetry
| Detectability | None |
|---|---|
| Data sources (ATT&CK data components) | Application Log ContentAsset InventoryDevice AlarmNetwork Traffic ContentNetwork Traffic FlowProcess/Event AlarmProcess History/Live Data |
Detection & response
Mitigated by 24
- M0800 attack-mitigation
- M0801 attack-mitigation
- M0804 attack-mitigation
- M0807 attack-mitigation
- M0810 attack-mitigation
- M0813 attack-mitigation
- M0814 attack-mitigation
- M0918 attack-mitigation
- M0930 attack-mitigation
D3-ABPId3fendD3-HBPId3fendD3-HRd3fendD3-HSd3fendD3-KBPId3fendD3-MANd3fendD3-MENCRd3fendD3-NTFd3fendD3-PLAd3fendD3-PSd3fendD3-PSAd3fendD3-PSMDd3fendD3-PTd3fendD3-SCFd3fendD3-WSAMd3fend
Detected by 2
Framework references
- Primary source: https://attack.mitre.org/matrices/ics/
- attack-ics: T0878 (primary)
- attack-ics: T0838
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Wireless, mobile, IoT and OT/ICS attacks' table, line 515 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE ICS ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 1 groups/software/campaigns reference this technique (ATT&CK ics v19.2)