Loading...
MITRE ATT&CK® for Industrial Control Systems
MITRE ATT&CK for ICS is a knowledge base of adversary tactics and techniques specific to industrial control systems. Version 18 documents 12 tactics and 83 techniques observed in real-world attacks against OT environments. It enables threat-informed defence by mapping adversary behaviour to detection and mitigation strategies.
12
Tactics
83
Techniques
v18
Current (Oct 2025)
ICS
Specific Matrix
Drive-by compromise, exploiting remote services, engineering workstation compromise, spearphishing, and command-line interface execution in OT environments.
Module firmware tampering, valid accounts abuse, remote services exploitation, default credentials, and lateral tool transfer between IT and OT networks.
Automated data collection, screen capture, data from information repositories, program upload, and C2 communications through commonly used OT protocols.
Damage to property, denial of control/view/service, loss of availability/control/productivity/safety, and manipulation of control or view in physical processes.
Map ICS assets (PLCs, HMIs, RTUs, engineering workstations) to the ATT&CK ICS matrix and identify applicable techniques.
Identify relevant threat groups and their known TTPs against your sector using ATT&CK threat group profiles.
Map current detection capabilities against each applicable technique to identify blind spots.
Create detection rules and analytics aligned to prioritized techniques using ATT&CK data sources.
Simulate adversary TTPs in controlled OT lab environments to validate detection and response capabilities.
Update technique mappings with each ATT&CK version release and re-assess detection gaps quarterly.