MITRE ATT&CK ICS Techniques

The techniques RadMah AI supports for ICS attack dataset generation, each with the effect it has on the simulated plant — measured on a composed plant against a same-seed clean run, never asserted.

Plant-effect vocabulary

Every technique below carries one or more of PHYSICAL (the plant’s true state diverges from the clean run), CONTROL (a command the process receives diverges from the operator’s intent), DENIAL (a command is blocked or frozen, or an operator sink’s delivery is dropped), OBSERVATION (an operator sink’s reported view diverges while the truth does not), SUPPRESSION (alarm rows are removed, re-thresholded or withheld from the operator) — or INERT alone, meaning the technique’s evidence is its security-event / host-event stream (and, for controller writes, the PLC register image), not the plant. The same field ships as process_effects on GET /v1/client/capabilities/mitre-ics and as technique_process_effects in every integrated run’s evidence bundle.

Write-side techniques (command path)

Write-side attacks change what the process RECEIVES. Every affected row in commands.ndjson carries its technique_id and a command_state; where the value on the wire is the attacker’s, write_source="attacker". A blocked or frozen command keeps its real originator and holds the last value the actuator received.

Technique	Name	Plant effect	What happens
T0831	Manipulation of Control	CONTROL PHYSICAL	The operator's setpoint is altered before the controller closes on it, so the plant follows the attacker's value. commands.ndjson rows carry command_state="manipulated", write_source="attacker" and the technique id; the observation rows the plant then moved are linked to the command that drove them.
T0835	Manipulate I/O Image	CONTROL PHYSICAL	The attacker's value is written straight into the I/O image, bypassing the controller's scan, and the plant follows it. Labelled command_state="manipulated" with divergence_reason="T0835:io_image_bypass", which is what distinguishes it from T0831.
T0836	Modify Parameter	CONTROL PHYSICAL	A controller tuning parameter is altered rather than the setpoint itself; the loop still runs, worse, and the plant diverges. Labelled command_state="parameter_modified" and write_source="attacker".
T0803	Block Command Message	DENIAL PHYSICAL	The command frame never reaches the actuator, which holds the last value it received. While the operator's setpoint is steady nothing moves; when it changes during the block the plant follows the old value and diverges from what the operator asked for. Labelled command_state="blocked" with divergence_reason="T0803:block_command_message"; write_source stays the operator, because the operator issued the command and the attacker stopped it.
T0821	Modify Controller Tasking	DENIAL PHYSICAL	The controller's scan schedule is altered so the command is never produced on time; the actuator holds its last value, with the same consequence as T0803 when the setpoint moves. Labelled command_state="frozen".
T0814	Denial of Service	DENIAL PHYSICAL	A flood on the controller's network denies both directions: the operator's commands do not reach the actuator (blocked, holding the last value) and the operator's sinks receive no reports (delivery dropped). The controller keeps executing its own loops.

Read-side techniques (observation path)

Read-side attacks change what the operator SEES. In the observation stream the per-sink reported_value diverges from true_value, and only rows whose reported view was actually changed carry the technique id.

Technique	Name	Plant effect	What happens
T0832	Manipulation of View	OBSERVATION	An offset, scaling or stale-hold transform is applied to the value the operator's sinks receive while the true and measured values are untouched. A discrete signal an offset cannot move is left alone and unlabelled.
T0856	Spoof Reporting Message	OBSERVATION	An earlier sample is delivered in place of the current one (delay or segment replay) while the underlying process moves on; freshness is "delayed" or "replayed".
T0804	Block Reporting Message	DENIAL	Delivery of the targeted signals to the targeted operator sinks is dropped (delivery_state="dropped"); the sink's display keeps its last value. Sustained drops while the truth moves derive T0829 Loss of View.
T0815	Denial of View	DENIAL	The full-blackout form of T0804: every signal, every operator sink, for the whole window.

Alarm-side techniques

Technique	Name	Plant effect	What happens
T0872	Indicator Removal on Host	SUPPRESSION	Alarm rows are deleted, truncated or overwritten in alarms.ndjson. The deleted rows are genuinely absent from the detector-facing stream; truth.ndjson carries their reference hashes so a scorer can verify the absence.
T0838	Modify Alarm Settings	SUPPRESSION	The band the operator's sinks see is widened (a high threshold multiplied by threshold_scale, a low one divided), so a real alarm condition clears on the HMI. The record keeps the true asserted condition; only the reported view is falsified.
T0878	Alarm Suppression	SUPPRESSION	Publication of the alarm to the operator's sinks is withheld (delivery_state="dropped" on the reported view) while the record stays asserted. Both T0838 and T0878 derive T0837 Loss of Protection.

Event-only techniques (inert on the plant)

These techniques are real in the security-event, host-event and PLC register-image artefacts and are labelled there; none of them changes the composed plant, its commands, its observations or its alarms, and the engine says so rather than stamping their windows onto untouched telemetry.

Technique	Name	Plant effect	What happens
T0802	Automated Collection	INERT	Bulk tag reads in the security-event stream.
T0807	Command-Line Interface	INERT	Shell / CLI process events and the operator-console log in host_events.ndjson.
T0809	Data Destruction	INERT	File deletion / corruption and the resulting missing-or-error-state alarm in host_events.ndjson.
T0816	Device Restart/Shutdown	INERT	The controller in the PLC register image (plc_state.json) enters a rebooting / stop mode; the composed plant is not touched.
T0819	Exploit Public-Facing Application	INERT	Service probe, exploit delivery, foothold and auth-anomaly rows.
T0830	Adversary-in-the-Middle	INERT	A certificate-swap network event. It does not alter what the operator sees.
T0846	Remote System Discovery	INERT	Discovery scan traffic and the host inventory query it returns.
T0853	Scripting	INERT	Script file creation and the command-history entry that invoked it.
T0855	Unauthorized Command Message	INERT	A write the operator never issued, applied to the PLC register image (plc_state.json) at the declared target_register / injected_value; it is not routed through the plant's controller.
T0857	System Firmware	INERT	A firmware version / hash change on the device in host_events.ndjson. The plant's behaviour does not change.
T0858	Change Operating Mode	INERT	The controller in the PLC register image enters program mode; the composed plant is not touched.
T0859	Valid Accounts	INERT	A successful login bound to the action taken in that session.
T0866	Exploitation of Remote Services	INERT	Remote-service error / auth bypass and the post-exploit execution it spawned.
T0867	Lateral Tool Transfer	INERT	A tool landing on a second host, with hash and size.
T0869	Standard Application Layer Protocol	INERT	Beaconing over an application protocol and the proxy / DNS log it leaves.
T0873	Project File Infection	INERT	An engineering project file's version / hash / diff change.
T0877	I/O Image	INERT	A sustained register sweep in the protocol traces. It reads the I/O image and changes nothing the operator sees.
T0882	Theft of Operational Information	INERT	An operational-data access log and the process read behind it. Nothing upstream of the plant is disrupted.
T0889	Modify Program	INERT	A program download on the wire and the controller in the PLC register image entering program mode; the composed plant is not touched.

Reconnaissance and derived impacts

T0840 Network Connection Enumeration, T0842 Network Sniffing and T0888 Remote System Information Discovery fire on the reconnaissance chain and are inert on the plant. The impact-tier techniques — T0826 Loss of Availability, T0827 Loss of Control, T0828 Loss of Productivity and Revenue, T0829 Loss of View, T0837 Loss of Protection, T0879 Damage to Property and T0880 Loss of Safety — are never requested directly: the engine derives each from a consequence a mechanism technique actually produced, and a run without that consequence carries no such row.

Ground-truth labelling

Every telemetry row carries a labels object with regime and anomaly; inside a technique’s window the row is labelled with the technique id, and its quality is marked uncertain only for a read-side technique — the one kind that makes the reading itself untrustworthy. Command rows carry ground_truth (clean / control_attack) plus the technique id; observation rows carry a view-attack label only where a sink’s view was changed; alarm rows carry an alarm-attack label only where a row was removed or its reported view falsified.

Customer code reaches the canonical technique catalog through GET /v1/client/capabilities/mitre-ics (consumed by the client-area MITRE panel and rady ics techniques); it is the source of truth for which technique ids the platform recognises and what each does.