The MITRE ATT&CK for ICS framework was released in January 2020 to augment the MITRE Corporation’s existing, widely used ATT&CK Knowledge Base. As MITRE’s newest framework, ATT&CK for ICS serves as the most comprehensive taxonomy of attack techniques and supporting methods leveraged by adversaries targeting industrial environments. As such, the framework is a useful tool for security teams wishing to ensure they’re covering all the bases in terms of being able to detect all potential OT security threats.
As Claroty Co-Founder Galina Antova has previously discussed at-length on our blog, threat detection is crucial to securing ICS environments. The Claroty Platform—which includes Continuous Threat Detection (CTD) and Secure Remote Access (SRA)—is capable of detecting all adversary techniques that correspond with each of the 11 tactics in the MITRE ATT&CK for ICS framework.
To achieve this granular visibility into these techniques and tactics—among others—Claroty leverages five detection engines designed to overcome common challenges that often hinder efforts to identify threats within ICS environments:
Leveraging the five detection engines above, The Claroty Platform can identify all of the adversary techniques that correspond with all 11 tactics covered in the MITRE ATT&CK for ICS framework. These include:
How an adversary gains their initial foothold within a victim’s ICS environment, such as drive-by compromise, engineering workstation compromise, external remote services, and the exploitation of public-facing applications, among others. Devices with privileges spanning both IT and OT environments are particularly susceptible to this tactic, along with IT resources within OT environments and external remote services.
Techniques that allow an adversary to run and control malicious code on a targeted system or device. For instance, an attacker may infect remote targets with programmed executables or leverage command-line interfaces, APIs, GUIs, or other available interfaces to issue execution commands.
How an adversary maintains their initial foothold within a compromised ICS environment despite potential disruptions such as restarts and credential changes. Specific techniques include replacing or hijacking project files and installing programs onto targeted devices.
Methods for avoiding detection by human operators and technical defenses during an attack. Evasion techniques may include removing indicators of compromise, spoofing communications and reporting, and abusing trusted devices and processes.
Methods used by adversaries to orient themselves and gather knowledge about an ICS environment’s internal network, devices, and processes in order to inform targeting and subsequent tactics. Discovery techniques include network communication enumeration, network sniffing, and control device identification.
Describes how an adversary moves throughout a compromised ICS environment, possibly gaining access to additional assets and privileges. Methods include the use of default credentials, program organization units, or the remote file copy technique.
How an adversary gathers data and domain knowledge to help inform their objectives within an ICS environment. This tactic is closely related to Discovery, and may include methods such as automated collection, data from information repositories, and point/tag identification.
Describes the technique an adversary uses to communicate with and control compromised ICS systems, devices, and platforms through vectors such as ports, connection proxies, and standard application layer protocol. Oftentimes, this tactic is carried out by adversaries using commonly available resources in a manner that mimics expected network traffic in order to avoid suspicion.
Techniques an adversary may use to prevent an organization from responding to failures, disruptions, and other anomalies within a targeted ICS environment, such as denial-of-service, alarm suppression, and the manipulation or destruction of data, programs, logic, devices, and communications.
Methods of disabling, manipulating, or damaging physical control processes—such as brute force I/O, changes in program state, unauthorized command messages, and the prevention or manipulation of reporting elements and control logic.
Lastly, the framework describes techniques for disrupting, manipulating, or destroying the integrity or availability of ICS systems, data, and their environment. Impact techniques—such as denial of control, loss of productivity and revenue, and theft of operational information—can greatly exacerbate short-term and long-term disruption and damage resulting from an ICS attack.