Change operating / firmware mode
PLC forced into stop, program or firmware-update mode
categoryWireless, mobile, IoT and OT/ICS attacksseverityVery HighdetectabilityNonelabnot yet measured
Classification
23 values: 14 reviewed, 8 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Wireless, mobile & IoT/OT |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | Medium |
| Resources required | Low |
| Likelihood / prevalence | Medium |
| Maturity | Established |
Impact & scope
| Severity | Very High |
|---|---|
| Impact | AvailabilityIntegritySafety |
| Platform | None |
| Environment | OT / ICS |
| Target asset class | Physical |
| Kill-chain phase (tactic) | Defense Evasion (legacy) (deprecated)ExecutionInhibit Response Function (ICS) |
Detection & telemetry
| Detectability | None |
|---|---|
| Data sources (ATT&CK data components) | Application Log ContentDevice AlarmNetwork Traffic Content |
Detection & response
Mitigated by 18
- M0800 attack-mitigation
- M0801 attack-mitigation
- M0802 attack-mitigation
- M0804 attack-mitigation
- M0807 attack-mitigation
- M0813 attack-mitigation
- M0930 attack-mitigation
- M0937 attack-mitigation
D3-ACHd3fendD3-CId3fendD3-DRAd3fendD3-MANd3fendD3-MENCRd3fendD3-NTFd3fendD3-OMMd3fendD3-OPRd3fendD3-RCd3fendD3-RFUMd3fend
Detected by 2
Framework references
- Primary source: https://attack.mitre.org/matrices/ics/
- attack-ics: T0858 (primary)
- attack-ics: T0800
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Wireless, mobile, IoT and OT/ICS attacks' table, line 516 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE ICS ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 1 groups/software/campaigns reference this technique (ATT&CK ics v19.2)
- ev-0003 (MITRE ICS ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 3 groups/software/campaigns reference this technique (ATT&CK ics v19.2)