MITRE ATT&CK for ICS
Summary: Dragos has published threat group profiles mapping adversary behaviors to the MITRE ATT&CK for ICS matrix, drawing on more than a decade of OT-specific telemetry and incident research. The mapped techniques include compromising dual-homed data historians as an IT-to-OT foothold, changing controller operating modes to reach engineering functions like Program Download, and leaving protection relays in firmware update mode to deny their normal functions.
Why it matters: The techniques catalogued here reach past the IT network into controller logic, relay modes, and physical process outcomes, including Loss of Safety and property damage - so a defender's detection coverage has to extend to the devices running the plant, not just the perimeter around them.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026