MITRE ATT&CK for ICS: Tactics, Techniques and Practical Use

What is MITRE ATT&CK for ICS?

MITRE ATT&CK is a publicly accessible knowledge base describing adversary behavior observed or reported in cyber operations. Its Industrial Control Systems (ICS) matrix focuses on environments that monitor or control physical processes, including PLCs, HMIs, engineering stations, industrial networks and related computing systems. It provides shared terminology for defenders to discuss attacker actions without relying only on malware names.

ATT&CK for ICS is not a legal regulation, a product certification, or a prediction that every factory will face every listed technique. It is a structured way to understand possible behaviors, map security monitoring, and identify gaps in protections.

Tactics, techniques and procedures are different

A tactic answers “Why is the attacker doing this?” It describes the immediate objective. The official ICS matrix groups techniques under 12 tactics: Initial Access, Execution, Persistence, Privilege Escalation, Evasion, Discovery, Lateral Movement, Collection, Command and Control, Inhibit Response Function, Impair Process Control, and Impact. These headings are not a compulsory sequence; an incident may skip, repeat or combine activities.

A technique answers “How could the objective be achieved?” For example, MITRE technique T0819, Exploit Public-Facing Application, describes exploiting exposed software to gain access. Technique T0843, Program Download, describes transferring a user program to an industrial controller; its sub-techniques include Download All, Online Edit and Program Append. MITRE explains that some program downloads can interrupt a physical process, making the operational implications different from an ordinary office software update.

A procedure is a specific real-world implementation of a technique by an observed adversary or tool. Procedures may vary considerably even when they share the same technique label. The ATT&CK descriptions and examples are supported by references, which should be read before drawing conclusions about any named incident.

How this applies inside a manufacturing plant

Consider a production site with remotely managed systems, an engineering workstation and multiple controllers. Rather than assuming an attack path, the security team can ask which entry points exist and which MITRE behaviors its controls could observe. Are external services exposed? Is access to engineering software restricted? Are controller program changes authorized and logged? Are communications between IT and OT systems monitored in a way that respects production requirements?

The team can map its evidence to relevant ATT&CK techniques, document what data sources might reveal a change, and identify important gaps. For instance, knowing that a PLC program download occurred may require access to controller audit information or engineering workstation records; ordinary firewall logs alone may not answer what logic was changed. ATT&CK is useful precisely because it encourages this distinction.

A practical way to use the matrix

Start by documenting the systems and functions that matter most, including safety and production-critical equipment. Select plausible adversary behaviors based on accessible services, remote connections, known incidents and vendor guidance. For each technique, document whether there are protections to prevent it, evidence to detect it, and a response procedure that can be used safely during production.

Next, validate assumptions with OT engineers. A security measure that blocks a necessary industrial protocol without planning could cause an outage. Likewise, a detection rule that treats every controller download as malicious may ignore legitimate commissioning and maintenance activity. Establish an approved baseline so deviations can be investigated intelligently.

ATT&CK can also improve tabletop exercises. Instead of claiming to have simulated a real attack, the team can discuss what it would do if an unauthorized engineering session were identified, if an HMI began communicating with an unexpected host, or if a controller configuration changed outside an approved maintenance window.

What ATT&CK cannot tell you

A technique entry does not prove that the behavior occurred in your network. MITRE’s matrix is not an exhaustive inventory of threats and cannot calculate plant-specific impact by itself. A meaningful assessment still requires asset information, network architecture, operational context and corroborating evidence.

Used carefully, MITRE ATT&CK for ICS connects cyber threat language with the physical realities of industrial operations. It helps teams ask better questions, prioritize appropriate monitoring and discuss cyber incidents with engineers and management using common terms.

Official sources and further reading

The resources below support the technical information discussed. Review current vendor advisories and applicable national law before making operational or compliance decisions.

• MITRE ATT&CK — ICS Matrixhttps://attack.mitre.org/matrices/ics/
• MITRE ATT&CK — ICS Tacticshttps://attack.mitre.org/tactics/ics/
• MITRE ATT&CK — Exploit Public-Facing Application (T0819)https://attack.mitre.org/techniques/T0819/
• MITRE ATT&CK — Program Download (T0843)https://attack.mitre.org/techniques/T0843/
• MITRE ATT&CK — Data & Toolshttps://attack.mitre.org/resources/attack-data-and-tools/