MA
Uploaded byMITRE ATT&CK
515 views

ATT&CK Updates- ATT&CK for ICS

The document discusses updates to the ATT&CK for ICS framework. It summarizes two recent incidents, the Colonial Pipeline ransomware attack and the Oldsmar water treatment plant hack, and highlights techniques used in each. It previews upcoming additions to ATT&CK for ICS in April 2022 and beyond, including new mapped mitigation objects, integration with other frameworks, mapping of ICS attacks to the enterprise ATT&CK, and the addition of detections for techniques. Future plans outlined include revisions to asset definitions based on ICS verticals and a blog series on technique sequences.

Embed presentation

Downloaded 100 times
ICS ATT&CK Updates Otis Alexander ATT&CK for ICS Lead @ojalexander ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
Colonial Pipeline • Operations impacted indirectly • Business continuity issues • Proactive management of risk during incident response • Loss of Availability (T0826) • Loss of Productivity and Revenue (T0828) • Growing trend of ransomware impacting ICS operations ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
Oldsmar Incident • Risks to water and wastewater systems • Unsecure remote access connections • Remote Services (T0886) • Graphical User Interface (T0823) • Modify Parameter (T0836) • Emphasis on importance of safety and resilience ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
Since the Last Time We Talked ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5 Technique Updates New Mitigation Objects Mapped to Each Technique NIST SP 800-53 and IEC 62443 to Mitigations ATT&CK for ICS STIX Bundle ATT&CK for ICS Integration into ATT&CK Navigator ICS Attacks Mapped to Enterprise ATT&CK
What’s Coming in April ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
On the Horizon ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
Asset Revamp based on ICS Verticals ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5 What do you call cyber assets in your vertical?
ATT&CK for ICS Detections! • Highlighted strategies used by major ICS vendors to detect techniques • Diverse set of data sources from ICS applications and operational databases • Inclusion of detection strategies for each technique ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
Modify Controller Tasking (T0821) Modify Program (T0889) System Firmware (T0857) Blog Series on Technique Sequences ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5 Drive-by Compromise (T0817) Project File Infection (T0873) Graphical User Interface (T0823) Replication Through Removable Media (T0847) Change Operating Mode (T0858) Program Download (T0843) Activate Firmware Update Mode (T0800) Remote System Information Discovery (T0888) Point and Tag Identification (T0861) Program Upload (T0847) OEM Website Workstation Controller Host-based Technique Network-based Technique Controller Supply Chain Compromise (T0862)
©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5 https://attack.mitre.org attack@mitre.org @mitreattack Otis Alexander @ojalexander

More Related Content

PDF
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
PDF
State of the ATT&CK
byMITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
PDF
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PDF
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 
The ATT&CK Latin American APT Playbook
byMITRE ATT&CK
 
State of the ATT&CK
byMITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
byMITRE ATT&CK
 
ATT&CK Updates- ATT&CK's Open Source
byMITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
byMITRE ATT&CK
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
ATT&CK Updates- Defensive ATT&CK
byMITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
byMITRE ATT&CK
 

What's hot

PDF
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
PDF
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
PDF
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PDF
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
PDF
The ATT&CK Philharmonic
byMITRE ATT&CK
 
PDF
Purple Team Exercise Framework Workshop #PTEF
byJorge Orchilles
 
PDF
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PDF
ATT&CKcon Intro
byMITRE ATT&CK
 
PPTX
ATT&CKing with Threat Intelligence
byChristopher Korban
 
PDF
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
PDF
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...
byJamieWilliams130
 
PDF
MITRE ATT&CK Framework
byn|u - The Open Security Community
 
PDF
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 
PDF
When Insiders ATT&CK!
byMITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
PDF
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
PDF
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
PDF
No Easy Breach DerbyCon 2016
byMatthew Dunwoody
 
Exploring how Students Map Social Engineering Techniques to the ATT&CK Framew...
byMITRE ATT&CK
 
ATT&CKING Containers in The Cloud
byMITRE ATT&CK
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
byMITRE ATT&CK
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
Projects to Impact- Operationalizing Work from the Center
byMITRE ATT&CK
 
The ATT&CK Philharmonic
byMITRE ATT&CK
 
Purple Team Exercise Framework Workshop #PTEF
byJorge Orchilles
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
byMITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
ATT&CKcon Intro
byMITRE ATT&CK
 
ATT&CKing with Threat Intelligence
byChristopher Korban
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
byMITRE ATT&CK
 
ATT&CKing Your Adversaries - Operationalizing cyber intelligence in your own ...
byJamieWilliams130
 
MITRE ATT&CK Framework
byn|u - The Open Security Community
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 
When Insiders ATT&CK!
byMITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
byMITRE ATT&CK
 
Threat Modelling - It's not just for developers
byMITRE ATT&CK
 
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
No Easy Breach DerbyCon 2016
byMatthew Dunwoody
 

Similar to ATT&CK Updates- ATT&CK for ICS

PDF
What's New with ATTACK for ICS?
byMITRE - ATT&CKcon
 
PDF
MITRE ATT&CK Updates: ICS
byMITRE ATT&CK
 
PDF
State of the ATT&CK May 2023
byAdam Pennington
 
PDF
ICS CERT- Incidence Reports
byDr Dev Kambhampati
 
PDF
[CLASS2014] Palestra Técnica - Franzvitor Fiorim
byTI Safe
 
PDF
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
byMITRE - ATT&CKcon
 
PDF
State of ATT&CK
byAdam Pennington
 
PDF
Cybersecurity Practices for Industrial Control Systems
byholloworangutanxjej
 
PPTX
ATTCKv11_for_RHISAC_may_2022
byTravis McWaters
 
PDF
Cyber Security in Manufacturing
byCentraComm
 
PDF
Dragos and CyberWire: ICS Ransomware
byDragos, Inc.
 
PPTX
ICS_Security_Use_Case_Presentation (1).pptx
bySubhashriC
 
PDF
Cybersecurity for modern industrial systems
byItex Solutions
 
PPT
Control system including PLC cybersecurity
byDr.Maged Mikhail
 
PPT
Power Grid Communications & Control Systems
byfajjarrehman
 
PPTX
Overload: Critical Lessons from 15 Years of ICS Vulnerabilities
byTripwire
 
PDF
ICS security
byAhmed Shitta
 
PDF
Becoming a Yogi on Mac ATT&CK with OceanLotus Postures
byAdam Pennington
 
PDF
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
byMITRE ATT&CK
 
PDF
amrapali builders -- maroochy water-services-case-study briefing.pdf
byamrapalibuildersreviews
 
What's New with ATTACK for ICS?
byMITRE - ATT&CKcon
 
MITRE ATT&CK Updates: ICS
byMITRE ATT&CK
 
State of the ATT&CK May 2023
byAdam Pennington
 
ICS CERT- Incidence Reports
byDr Dev Kambhampati
 
[CLASS2014] Palestra Técnica - Franzvitor Fiorim
byTI Safe
 
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
byMITRE - ATT&CKcon
 
State of ATT&CK
byAdam Pennington
 
Cybersecurity Practices for Industrial Control Systems
byholloworangutanxjej
 
ATTCKv11_for_RHISAC_may_2022
byTravis McWaters
 
Cyber Security in Manufacturing
byCentraComm
 
Dragos and CyberWire: ICS Ransomware
byDragos, Inc.
 
ICS_Security_Use_Case_Presentation (1).pptx
bySubhashriC
 
Cybersecurity for modern industrial systems
byItex Solutions
 
Control system including PLC cybersecurity
byDr.Maged Mikhail
 
Power Grid Communications & Control Systems
byfajjarrehman
 
Overload: Critical Lessons from 15 Years of ICS Vulnerabilities
byTripwire
 
ICS security
byAhmed Shitta
 
Becoming a Yogi on Mac ATT&CK with OceanLotus Postures
byAdam Pennington
 
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
byMITRE ATT&CK
 
amrapali builders -- maroochy water-services-case-study briefing.pdf
byamrapalibuildersreviews
 

More from MITRE ATT&CK

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
byMITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
byMITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
byMITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
byMITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
byMITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
byMITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
byMITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
byMITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
byMITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
byMITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
byMITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
byMITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
byMITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
byMITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
byMITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
byMITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
byMITRE ATT&CK
 

Recently uploaded

PPTX
Advance Computer Architecture Lecture 4.pptx
byBottshikanBottshikan
 
PPT
Database Management Systems: Basics, History, Data Models, etc.
byParithi Thamizh
 
PPTX
Code Like Bro -A guide for better Coding
byMadan Panthi
 
PDF
apidays Australia 2025 | The Strategic Role of APIs in Digital Transformation
byapidays
 
PPT
connectives-linking words in English.ppt
byAmrMohammed82
 
PPTX
Understanding-Search-Algorithms_09-12-25.pptx
byshaikmahammedtauheed
 
PDF
Teaching Robots how to Read 1/2: AI Center & Classic Document Understanding (...
byanabulhac
 
PDF
Getting the Best of TrueDEM – January News & Updates
bypanagenda
 
PDF
Transcript: What ONIX can do: Leveraging metadata to support the discoverabil...
byBookNet Canada
 
PDF
Talaria: A Sound-Driven Music Search Engine for Discovery Beyond Metadata
byShuen-Huei Guan
 
PDF
apidays Australia 2025 | User Brainpower vs. AI Blind Spots in API Docs
byapidays
 
PPTX
AI and Digital Transformation Solutions.
byBuildingblocks
 
PPTX
apidays Australia 2025 | Building AI RAG Applications with No Code.pptx
byapidays
 
PDF
What ONIX can do: Leveraging metadata to support the discoverability of First...
byBookNet Canada
 
PDF
How to Build a Crypto Wallet that Excels in 2026.pdf
byimoliviabennett
 
PPTX
Mastering SQL Server Replication: Types, Setup & Troubleshooting
byGeoPITS Global Pvt Ltd
 
PPTX
Single Cell Protein from Methane or Methanol - Process development research c...
byJohn Downs
 
PPTX
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
PDF
Kubernetes Cloud Native Indonesia Meetup - January 2026
byPrasta Maha
 
PPTX
Strategic Shelf Planning for the New Year Turning Resolutions into Revenue .pptx
byAnoop Ashok
 
Advance Computer Architecture Lecture 4.pptx
byBottshikanBottshikan
 
Database Management Systems: Basics, History, Data Models, etc.
byParithi Thamizh
 
Code Like Bro -A guide for better Coding
byMadan Panthi
 
apidays Australia 2025 | The Strategic Role of APIs in Digital Transformation
byapidays
 
connectives-linking words in English.ppt
byAmrMohammed82
 
Understanding-Search-Algorithms_09-12-25.pptx
byshaikmahammedtauheed
 
Teaching Robots how to Read 1/2: AI Center & Classic Document Understanding (...
byanabulhac
 
Getting the Best of TrueDEM – January News & Updates
bypanagenda
 
Transcript: What ONIX can do: Leveraging metadata to support the discoverabil...
byBookNet Canada
 
Talaria: A Sound-Driven Music Search Engine for Discovery Beyond Metadata
byShuen-Huei Guan
 
apidays Australia 2025 | User Brainpower vs. AI Blind Spots in API Docs
byapidays
 
AI and Digital Transformation Solutions.
byBuildingblocks
 
apidays Australia 2025 | Building AI RAG Applications with No Code.pptx
byapidays
 
What ONIX can do: Leveraging metadata to support the discoverability of First...
byBookNet Canada
 
How to Build a Crypto Wallet that Excels in 2026.pdf
byimoliviabennett
 
Mastering SQL Server Replication: Types, Setup & Troubleshooting
byGeoPITS Global Pvt Ltd
 
Single Cell Protein from Methane or Methanol - Process development research c...
byJohn Downs
 
API Gateway Architecture - Technical Report 2026
byPowersoft2026
 
Kubernetes Cloud Native Indonesia Meetup - January 2026
byPrasta Maha
 
Strategic Shelf Planning for the New Year Turning Resolutions into Revenue .pptx
byAnoop Ashok
 

ATT&CK Updates- ATT&CK for ICS

  • 1.
    ICS ATT&CK Updates OtisAlexander ATT&CK for ICS Lead @ojalexander ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
  • 2.
    ©2022 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
  • 3.
    Colonial Pipeline • Operationsimpacted indirectly • Business continuity issues • Proactive management of risk during incident response • Loss of Availability (T0826) • Loss of Productivity and Revenue (T0828) • Growing trend of ransomware impacting ICS operations ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
  • 4.
    Oldsmar Incident • Risksto water and wastewater systems • Unsecure remote access connections • Remote Services (T0886) • Graphical User Interface (T0823) • Modify Parameter (T0836) • Emphasis on importance of safety and resilience ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
  • 5.
    Since the LastTime We Talked ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5 Technique Updates New Mitigation Objects Mapped to Each Technique NIST SP 800-53 and IEC 62443 to Mitigations ATT&CK for ICS STIX Bundle ATT&CK for ICS Integration into ATT&CK Navigator ICS Attacks Mapped to Enterprise ATT&CK
  • 6.
    What’s Coming inApril ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
  • 7.
    On the Horizon ©2022The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
  • 8.
    Asset Revamp basedon ICS Verticals ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5 What do you call cyber assets in your vertical?
  • 9.
    ATT&CK for ICSDetections! • Highlighted strategies used by major ICS vendors to detect techniques • Diverse set of data sources from ICS applications and operational databases • Inclusion of detection strategies for each technique ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5
  • 10.
    Modify Controller Tasking(T0821) Modify Program (T0889) System Firmware (T0857) Blog Series on Technique Sequences ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5 Drive-by Compromise (T0817) Project File Infection (T0873) Graphical User Interface (T0823) Replication Through Removable Media (T0847) Change Operating Mode (T0858) Program Download (T0843) Activate Firmware Update Mode (T0800) Remote System Information Discovery (T0888) Point and Tag Identification (T0861) Program Upload (T0847) OEM Website Workstation Controller Host-based Technique Network-based Technique Controller Supply Chain Compromise (T0862)
  • 11.
    ©2022 The MITRECorporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21-01255-5 https://attack.mitre.org attack@mitre.org @mitreattack Otis Alexander @ojalexander