Historian compromise
Process history data stolen or altered
categoryWireless, mobile, IoT and OT/ICS attacksseverityHighdetectabilityNonelabnot yet measured
Classification
22 values: 14 reviewed, 7 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Wireless, mobile & IoT/OT |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | Medium |
| Resources required | Low |
| Likelihood / prevalence | Medium |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | None |
| Environment | OT / ICS |
| Target asset class | Data storeServer |
| Kill-chain phase (tactic) | CollectionImpact |
Detection & telemetry
| Detectability | None |
|---|---|
| Data sources (ATT&CK data components) | Application Log ContentLogon Session Creation |
Detection & response
Mitigated by 16
- M0803 attack-mitigation
- M0809 attack-mitigation
- M0917 attack-mitigation
- M0918 attack-mitigation
- M0922 attack-mitigation
- M0926 attack-mitigation
- M0941 attack-mitigation
- M0947 attack-mitigation
D3-AVEd3fendD3-MANd3fendD3-MENCRd3fendD3-NTFd3fendD3-OPMd3fendD3-RSd3fendD3-SUd3fendD3-SWId3fend
Detected by 2
Framework references
- Primary source: https://attack.mitre.org/matrices/ics/
- attack-ics: T0811 (primary)
- attack-ics: T0882
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Wireless, mobile, IoT and OT/ICS attacks' table, line 511 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE ICS ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 1 groups/software/campaigns reference this technique (ATT&CK ics v19.2)
- ev-0003 (MITRE ICS ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 5 groups/software/campaigns reference this technique (ATT&CK ics v19.2)