PLC logic manipulation
Modified program or parameters downloaded to a controller
categoryWireless, mobile, IoT and OT/ICS attacksseverityVery HighdetectabilityNonelabnot yet measured
Classification
25 values: 14 reviewed, 10 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Wireless, mobile & IoT/OT |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | High |
| Resources required | Medium |
| Likelihood / prevalence | Medium |
| Maturity | Established |
Impact & scope
| Severity | Very High |
|---|---|
| Impact | AvailabilityIntegritySafety |
| Platform | None |
| Environment | OT / ICS |
| Target asset class | Physical |
| Kill-chain phase (tactic) | Impair Process Control (ICS)Lateral MovementPersistence |
Detection & telemetry
| Detectability | None |
|---|---|
| Data sources (ATT&CK data components) | Application Log ContentAsset InventoryDevice AlarmNetwork Traffic ContentSoftware |
Detection & response
Mitigated by 20
- M0800 attack-mitigation
- M0801 attack-mitigation
- M0802 attack-mitigation
- M0804 attack-mitigation
- M0807 attack-mitigation
- M0813 attack-mitigation
- M0818 attack-mitigation
- M0930 attack-mitigation
- M0937 attack-mitigation
- M0945 attack-mitigation
- M0947 attack-mitigation
D3-AVEd3fendD3-MANd3fendD3-MENCRd3fendD3-NTFd3fendD3-OVARd3fendD3-RSd3fendD3-SBVd3fendD3-SUd3fendD3-SWId3fend
Detected by 3
Framework references
- Primary source: https://attack.mitre.org/matrices/ics/
- attack-ics: T0889 (primary)
- attack-ics: T0836
- attack-ics: T0843
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Wireless, mobile, IoT and OT/ICS attacks' table, line 502 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE ICS ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 2 groups/software/campaigns reference this technique (ATT&CK ics v19.2)
- ev-0003 (MITRE ICS ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 4 groups/software/campaigns reference this technique (ATT&CK ics v19.2)
- ev-0004 (MITRE ICS ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 6 groups/software/campaigns reference this technique (ATT&CK ics v19.2)