SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Physical, insider and cross-cutting attacks

Cyber warfare / state destructive attacks

State malware disables grids or wipes networks

categoryPhysical, insider and cross-cutting attacksseverityVery HighdetectabilityHighlabnot yet measured

Example: BlackEnergy, Industroyer, NotPetya

Classification

37 values: 23 imported, 1 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Malware
Reach (CVSS)	Network
Attack complexity	High
Privileges required	None
User interaction	None
Attacker skill required	High
Resources required	High
Likelihood / prevalence	Low
Maturity	Established

Impact & scope

Severity	Very High
Impact	Availability
Platform	ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows
Environment	On-premisesOT / ICS
Target asset class	Data storeServer
Kill-chain phase (tactic)	Impact

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Cloud Storage DeletionCommand ExecutionDrive AccessDrive ModificationDriver LoadFile CreationFile DeletionProcess CreationProcess TerminationUser Account AuthenticationUser Account MetadataVolume Deletion

Detection & response

Mitigated by 4

M1018 attack-mitigation
M1032 attack-mitigation
M1053 attack-mitigation
D3-DKP d3fend

Detected by 23

DET0137 attack-detection-strategy
DET0146 attack-detection-strategy
00321fee-ca72-4cce-b011-5415af3b9960 sigma
08d6ac24-c927-4469-b3b7-2e422d6e3c43 sigma
12d027c3-b48c-4d9d-8bb6-a732200034b2 sigma
25cb259b-bbdc-4b87-98b7-90d7c72f8743 sigma
2953194b-e33c-4859-b9e8-05948c167447 sigma
33d50d03-20ec-4b74-a74e-1e65a38af1c0 sigma
37222991-11e9-4b6d-8bdf-60fbe48f753e sigma
39a80702-d7ca-4a83-b776-525b1f86a36d sigma
46530378-f9db-4af9-a9e5-889c177d3881 sigma
4b046706-5789-4673-b111-66f25fe99534 sigma
6a7ba45c-63d8-473e-9736-2eaabff79964 sigma
71d65515-c436-43c0-841b-236b1f32c21e sigma
78a34b67-3c39-4886-8fb4-61c46dc18ecd sigma
7ee0b4aa-d8d4-4088-b661-20efdf41a04c sigma
818fee0c-e0ec-4e45-824e-83e4817b0887 sigma
93e0ef48-37c8-49ed-a02c-038aab23628e sigma
9541f321-7cba-4b43-80fc-fbd1fb922808 sigma
999e8307-a775-4d5f-addc-4855632335be sigma
a4824fca-976f-4964-b334-0621379e84c4 sigma
add64136-62e5-48ea-807e-88638d02df1e sigma
c1d867fe-8d95-4487-aab4-e53f2d339f90 sigma

Tested by 5

1207ddff-f25b-41b3-aa0e-7c26d2b546d1 atomic
321fd25e-0007-417f-adec-33232252be19 atomic
38deee99-fd65-4031-bec8-bfa4f9f26146 atomic
476419b5-aebf-4366-a131-ae3e8dae5fc2 atomic
4ac71389-40f4-448a-b73f-754346b3f928 atomic

Framework references

Primary source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a
attack: T1561 (primary)
attack: T1485

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Physical, insider and cross-cutting attacks' table, line 704 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1561, attack:T1485 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 40 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)