MITRE ATT&CK for ICS

What is MITRE ATT&CK for ICS?

MITRE ATT&CK for ICS is a freely available knowledge base that describes the tactics and techniques attackers use against industrial control systems, based on attacks observed in real OT environments. The model follows an attack from initial access to the moment an attacker disrupts the physical process, undermines safety or leaves the operator blind. MITRE published the first official version on 7 January 2020, a year after an initial preview at the S4 conference in January 2019. For defenders it is above all a common language: a SOC, a CERT, a vendor and a process engineer all mean exactly the same thing by “Modify Parameter” or “Alarm Suppression”.

ATT&CK for ICS helps organisations to understand, detect and prevent attacks on factories, power stations and water utilities, with a structure tailored to critical infrastructure.

🧠 How is ATT&CK for ICS structured?

The model consists of a matrix of tactics (the attacker’s goal in a given phase) and techniques (the way the attacker reaches that goal). Around it sit objects that make the matrix usable:

• Techniques and sub-techniques - each with an ID such as T0878 (Alarm Suppression). Since version 19 (April 2026), ICS also has sub-techniques, for example Unauthorized Message with the variants Command Message and Reporting Message, and Program Download with Download All, Online Edit and Program Append.
• Assets - the OT components a technique targets, such as the PLC, HMI, historian, RTU, safety controller and engineering workstation. MITRE re-added these in October 2023 (v14) and extended them in October 2025 (v18) with, among others, DCS controllers, firewalls and switches.
• Groups, software and campaigns - who has used which techniques in practice, with references to public analyses.
• Mitigations - measures with IDs between M0800 and M0954, such as Network Allowlists (M0807) and Network Segmentation (M0930).
• Detection strategies - since v18 these replace the short detection paragraphs per technique with fully worked strategies and analytics.

MITRE usually ships two releases a year, in April and October. For ICS, version 19 contains 12 tactics, 79 techniques, 18 sub-techniques, 14 groups, 23 software families, 8 campaigns, 52 mitigations and 18 asset types.

🧭 Which tactics does ATT&CK for ICS contain?

The twelve tactics run roughly from left to right through an attack. The tactics Inhibit Response Function and Impair Process Control exist only in the ICS domain.

The difference from an IT attack lies mainly in the last three columns. An attacker who reprograms a PLC does not need to steal or encrypt data: the effect is physical, such as an overflowing tank, a disabled safety function or an operator who can no longer see the process.

🔄 How does it differ from MITRE ATT&CK for Enterprise?

MITRE ATT&CK has three domains: Enterprise, Mobile and ICS. Enterprise describes attacks on Windows, Linux, cloud and network equipment. ICS focuses on the systems that control and monitor the physical process.

In practice you use both side by side. Many OT incidents start in the IT network, for example with phishing or abuse of remote access, and then reach OT through lateral movement. Enterprise describes that first part, ICS the part where the process is hit.

🔍 Which real attacks are documented in ATT&CK for ICS?

MITRE backs up its techniques with documented incidents. Well-known examples:

• Maroochy Water Breach (2000) - a former employee of the installation contractor used radio to manipulate sewage pumping stations in Australia and suppressed alarm reporting to the central computer (Alarm Suppression).
• Attacks on the Ukrainian power grid (2015, 2016 and 2022) - attributed to Sandworm, using among others BlackEnergy and Industroyer; techniques such as Unauthorized Message and Loss of View.
• TRITON (2017) - an attack on a safety system at a petrochemical plant, attributed to XENOTIME; the textbook example of Inhibit Response Function and Loss of Safety.
• Unitronics campaign (2023) - the group CyberAv3ngers defaced the HMIs of Unitronics PLCs, including in the water sector.
• FrostyGoop (2024) - heating to more than 600 apartment blocks in Lviv was cut off via Modbus TCP.

Stuxnet and PIPEDREAM (registered by MITRE as INCONTROLLER) also appear in the ICS domain as software. Volt Typhoon is listed as a group in the Enterprise domain: its documented techniques concern the IT systems of critical infrastructure, not yet the control process itself.

🏭 How do you use ATT&CK for ICS in practice?

• Design detection - translate techniques into rules in a SIEM, an IDS or NDR for OT, and into the playbooks of the OT SOC. EDR mainly covers Windows systems such as HMIs and engineering stations.
• Measure coverage - use the ATT&CK Navigator to colour in, per technique, whether you can see it and where your blind spots are.
• Test your architecture - check whether your Purdue Model, Defense in Depth architecture and network segmentation block the main attack paths.
• Justify investments - show which techniques a Firewall, Access Control or better management of the Engineering Station covers.
• Analyse incidents - map observations during Incident Response to techniques, so you can anticipate the attacker’s next step.
• Train - use techniques as scenarios for Red Team, Blue Team, Purple Team and tabletop exercises, and as hypotheses for Threat Hunting.
• Compare vendors - in July 2021 MITRE Engenuity ran the first ATT&CK Evaluations for ICS, in which Armis, Claroty, Dragos, III and Microsoft had to detect the TRITON attack.

🛠️ How do you map your coverage step by step?

1. Choose relevant threats - use Threat Intelligence to identify the groups and campaigns that affect your sector, such as energy or water.
2. Lay your assets alongside the matrix - determine which ATT&CK asset types you have. Without an asset inventory you cannot tell which techniques are relevant.
3. Select priority techniques - start with techniques that recur across several incidents, such as Remote System Discovery, Program Download, Modify Parameter and Alarm Suppression.
4. Assess visibility - check per technique whether logging, passive monitoring or process data make the behaviour visible.
5. Link countermeasures - use the ATT&CK mitigations and MITRE D3FEND to choose defensive measures.
6. Test and repeat - validate detections with a controlled simulation and update the map after every new ATT&CK release.

An example: Alarm Suppression (T0878) lists Network Allowlists (M0807), Network Segmentation (M0930), an out-of-band communications channel (M0810) and a static network configuration (M0814) among its mitigations. For detection you look at the loss of network traffic, process data or alarms. These are indirect signals, so you combine them with knowledge of the normal process.

🔐 How does ATT&CK for ICS fit with standards and legislation?

ATT&CK for ICS is neither a tool nor a compliance framework, but a knowledge base on which you base defensive measures. It does support what standards and laws ask of you:

• IEC 62443 - in a risk assessment according to IEC 62443-3-2, ATT&CK makes the threat scenarios concrete.
• NIS2 - the Dutch implementation, the Cyberbeveiligingswet, has been in force since 15 August 2026 and requires appropriate measures and incident reporting. ATT&CK helps you describe incidents consistently to the NCSC.
• ISO 27001 - ATT&CK feeds the threat analysis in risk management and vulnerability management.

In this way it contributes to demonstrable compliance without being a requirement itself. Stronger OT awareness across these activities is one of its most practical security benefits.

❓ Frequently asked questions

Is MITRE ATT&CK for ICS free to use?

MITRE ATT&CK for ICS is free and publicly available through the MITRE website and as machine-readable data. Organisations may use the knowledge base in their own tools, reports and training. Many vendors of OT monitoring map their detections to it.

How many techniques does ATT&CK for ICS contain?

ATT&CK for ICS version 19, released in April 2026, contains 79 techniques and 18 sub-techniques across 12 tactics. The number changes with each release, which usually appears in April and October. Always check the current matrix.

What is the difference between ATT&CK for ICS and the Cyber Kill Chain?

The Cyber Kill Chain describes seven high-level phases of an attack. MITRE ATT&CK for ICS goes into far more detail on concrete techniques, with examples from real incidents and associated mitigations. Many organisations use the Kill Chain for the overview and ATT&CK for detection and analysis.

What are TTPs in ATT&CK for ICS?

TTPs stands for tactics, techniques and procedures. In MITRE ATT&CK for ICS, tactics are the goals, techniques the methods and procedures the concrete execution by a group or piece of malware. Detecting TTPs is valuable because attackers find it much harder to change how they work than to change an IP address or a file hash.

Is ATT&CK for ICS useful for a small organisation?

A small organisation also benefits from MITRE ATT&CK for ICS, mainly as a checklist of the most important attack paths. Start with a handful of common techniques, such as abuse of remote access and program downloads to PLCs. That way the matrix steers a limited budget towards the measures with the greatest effect.

How does ATT&CK for ICS relate to MITRE D3FEND?

MITRE ATT&CK for ICS describes what attackers do, while MITRE D3FEND describes defensive techniques. By linking the two, you see which defence helps against which attack technique. D3FEND is mainly IT-oriented, so in OT you complement it with the ICS mitigations in ATT&CK itself.

📌 In summary

MITRE ATT&CK for ICS is the public knowledge base, grounded in real incidents, that describes in 12 tactics how attackers break into industrial control systems, stay hidden and disrupt the physical process. Use it as a common language for detection, risk assessment and exercises, and combine it with segmentation, monitoring and D3FEND to protect your OT environment demonstrably better.