MITRE ICS ATT&CK Matrix

Color-coded by number of available mitigations from official MITRE data. Hover for details, click to view documentation.

94/94

Mitigations:

↑↓←→ Navigate • Enter Open • Home/End Jump

Initial Access12 techniques

Drive-by Compromise

Exploit Public-Facing Application

Exploitation of Remote Services

External Remote Services

Internet Accessible Device

Remote Services

Replication Through Removable Media

Rogue Master

Spearphishing Attachment

Supply Chain Compromise

Transient Cyber Asset

Wireless Compromise

Execution10 techniques

Change Operating Mode

Command-Line Interface

Execution through API

Graphical User Interface

Hooking

Modify Controller Tasking

Native API

Scripting

User Execution

Autorun Image

Persistence6 techniques

Modify Program

Module Firmware

Project File Infection

System Firmware

Valid Accounts

Hardcoded Credentials

Privilege Escalation2 techniques

Exploitation for Privilege Escalation

Hooking

Evasion7 techniques

Change Operating Mode

Exploitation for Evasion

Indicator Removal on Host

Masquerading

Rootkit

Spoof Reporting Message

System Binary Proxy Execution

Discovery5 techniques

Remote System Discovery

Remote System Information Discovery

Network Connection Enumeration

Network Sniffing

Wireless Sniffing

Lateral Movement7 techniques

Default Credentials

Exploitation of Remote Services

Hardcoded Credentials

Lateral Tool Transfer

Program Download

Remote Services

Valid Accounts

Collection11 techniques

Adversary-in-the-Middle

Automated Collection

Data from Information Repositories

Data from Local System

Detect Operating Mode

I/O Image

Monitor Process State

Point & Tag Identification

Program Upload

Screen Capture

Wireless Sniffing

Command and Control3 techniques

Commonly Used Port

Connection Proxy

Standard Application Layer Protocol

Inhibit Response Function14 techniques

Activate Firmware Update Mode

Alarm Suppression

Block Command Message

Block Reporting Message

Block Serial COM

Change Credential

Data Destruction

Denial of Service

Device Restart/Shutdown

Manipulate I/O Image

Modify Alarm Settings

Rootkit

Service Stop

System Firmware

Impair Process Control5 techniques

Brute Force I/O

Modify Parameter

Module Firmware

Spoof Reporting Message

Unauthorized Command Message

Impact12 techniques

Damage to Property

Denial of Control

Denial of View

Loss of Availability

Loss of Control

Loss of Productivity and Revenue

Loss of Protection

Loss of Safety

Loss of View

Manipulation of Control

Manipulation of View

Theft of Operational Information

Tap card for details, tap arrow icon to view on MITRE ATT&CK

Data sourced from official MITRE ATT&CK ICS v18View full matrix

ICS Threat Actors

Known threat groups targeting Industrial Control Systems. Click on an actor to view their profile, techniques used, and associated malware.

Loading threat actors...

MITRE ICS ATT&CK Framework

Interactive visualization of adversary tactics and techniques targeting Industrial Control Systems. Click on any tactic to explore its associated techniques.

Initial Access

10 techniques

Techniques used to gain an initial foothold within an ICS environment

T0817T0819T0866+7 more

Execution

9 techniques

Techniques that run adversary-controlled code on local or remote systems

T0858T0807T0871+6 more

Persistence

5 techniques

Techniques to maintain foothold across restarts and credential changes

T0889T0839T0873+2 more

Evasion

6 techniques

Techniques to avoid detection throughout the compromise

T0858T0820T0872+3 more

Discovery

5 techniques

Techniques to gain knowledge about the system and network

T0840T0842T0846+2 more

Lateral Movement

6 techniques

Techniques to move through the environment and access other systems

T0812T0866T0867+3 more

Collection

8 techniques

Techniques to gather data of interest to adversary goals

T0868T0877T0830+5 more

Command and Control

3 techniques

Techniques for communication with compromised systems

T0885T0884T0869

Inhibit Response Function

14 techniques

Techniques to prevent safety and protective functions from triggering

T0800T0878T0803+11 more

Impair Process Control

5 techniques

Techniques to manipulate and disrupt physical process control

T0806T0836T0839+2 more

Impact

12 techniques

Techniques to manipulate, interrupt, or destroy systems and data

T0879T0813T0815+9 more

Tactics

83+

Techniques

ICS

Focus Area

Environment

View full MITRE ATT&CK for ICS Matrix

Related Resources

MITRE ICS ATT&CK Framework Guide

A comprehensive breakdown of the framework and how to use it effectively.

Read article

OT Threat Intelligence Guide

Learn how to leverage threat intelligence for OT/ICS environments.

Read article

IEC 62443 Compliance Guide

Map MITRE techniques to IEC 62443 security requirements.

Read article

About the MITRE ICS ATT&CK Framework

The MITRE ATT&CK for Industrial Control Systems (ICS) framework is a comprehensive knowledge base documenting adversary tactics, techniques, and procedures (TTPs) used against operational technology environments. Unlike traditional IT-focused frameworks, MITRE ICS ATT&CK specifically addresses threats targeting SCADA systems, programmable logic controllers (PLCs), distributed control systems (DCS), and other industrial automation equipment.

This interactive explorer allows security professionals to navigate the complete MITRE ICS matrix, understand attack patterns used by threat actors like XENOTIME, ELECTRUM, and SANDWORM, and identify appropriate mitigations for each technique. Use the matrix above to explore tactics from Initial Access through Impact, view associated threat actors, and understand how adversaries move through OT environments.

Each technique card displays available mitigations and links to official MITRE documentation. Color-coded borders indicate mitigation coverage: red for techniques with no mitigations, orange for limited coverage, and blue/cyan for well-mitigated techniques. Click any technique to view detailed procedure examples, targeted assets, and detection guidance.