CyberStrikeus/CyberStrike - Page 85

t0853-scripting

Adversaries may use scripting languages to execute arbitrary code in the form of a pre-written script or in the form of user-supplied code to an interpreter.

t0858-change-operating-mode

Adversaries may change the operating mode of a controller to gain additional access to engineering functions such as Program Download.

t0863-user-execution

Adversaries may rely on a targeted organizations user interaction for the execution of malicious code.

t0871-execution-through-api

Adversaries may attempt to leverage Application Program Interfaces (APIs) used for communication between control software and the hardware.

t0874-hooking

Adversaries may hook into application programming interface (API) functions used by processes to redirect calls for execution and privilege escalation means.

t0895-autorun-image

Adversaries may leverage AutoRun functionality or scripts to execute malicious code.

t0813-denial-of-control

Adversaries may cause a denial of control to temporarily prevent operators and engineers from interacting with process controls.

t0815-denial-of-view

Adversaries may cause a denial of view in attempt to disrupt and prevent operator oversight on the status of an ICS environment.

t0826-loss-of-availability

Adversaries may attempt to disrupt essential components or systems to prevent owner and operator from delivering products or services.

t0827-loss-of-control

Adversaries may seek to achieve a sustained loss of control or a runaway condition in which operators cannot issue any commands even if the malicious interference has subsided.

t0828-loss-of-productivity-and-revenue

Adversaries may cause loss of productivity and revenue through disruption and even damage to the availability and integrity of control system operations, devices, and related processes.

t0829-loss-of-view

Adversaries may cause a sustained or permanent loss of view where the ICS equipment will require local, hands-on operator intervention; for instance, a restart or manual operation.

t0831-manipulation-of-control

Adversaries may manipulate physical process control within the industrial environment.

t0832-manipulation-of-view

Adversaries may attempt to manipulate the information reported back to operators or controllers.

t0837-loss-of-protection

Adversaries may compromise protective system functions designed to prevent the effects of faults and abnormal conditions.

t0879-damage-to-property

Adversaries may cause damage and destruction of property to infrastructure, equipment, and the surrounding environment when attacking control systems.

t0880-loss-of-safety

Adversaries may compromise safety system functions designed to maintain safe operation of a process when unacceptable or dangerous conditions occur.

t0882-theft-of-operational-information

Adversaries may steal operational information on a production environment as a direct mission outcome for personal gain or to inform future operations.

t0806-brute-force-io

Adversaries may repetitively or successively change I/O point values to perform an action.

t0836-modify-parameter

Adversaries may modify parameters used to instruct industrial control system devices.

t0855-unauthorized-command-message

Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger thei...

t0800-activate-firmware-update-mode

Adversaries may activate firmware update mode on devices to prevent expected response functions from engaging in reaction to an emergency or process malfunction.

t0803-block-command-message

Adversaries may block a command message from reaching its intended target to prevent command execution.

t0804-block-reporting-message

Adversaries may block or prevent a reporting message from reaching its intended target.

t0805-block-serial-com

Adversaries may block access to serial COM to prevent instructions or configurations from reaching target devices.

t0809-data-destruction

Adversaries may perform data destruction over the course of an operation.

t0814-denial-of-service

Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality.

t0816-device-restartshutdown

Adversaries may forcibly restart or shutdown a device in an ICS environment to disrupt and potentially negatively impact physical processes.

t0835-manipulate-io-image

Adversaries may manipulate the I/O image of PLCs through various means to prevent them from functioning as expected.

t0838-modify-alarm-settings

Adversaries may modify alarm settings to prevent alerts that may inform operators of their presence or to prevent responses to dangerous and unintended scenarios.

t0878-alarm-suppression

Adversaries may target protection function alarms to prevent them from notifying operators of critical conditions.

t0881-service-stop

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

t0892-change-credential

Adversaries may modify software and device credentials to prevent operator and responder access.

t0817-drive-by-compromise

Adversaries may gain access to a system during a drive-by compromise, when a user visits a website as part of a regular browsing session.

t0819-exploit-public-facing-application

Adversaries may leverage weaknesses to exploit internet-facing software for initial access into an industrial network.

t0822-external-remote-services

Adversaries may leverage external remote services as a point of initial access into your network.

t0847-replication-through-removable-media

Adversaries may move onto systems, such as those separated from the enterprise network, by copying malware to removable media which is inserted into the control systems environment.

t0848-rogue-master

Adversaries may setup a rogue master to leverage control server functions to communicate with outstations.

t0860-wireless-compromise

Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network.

t0862-supply-chain-compromise

Adversaries may perform supply chain compromise to gain control systems environment access by means of infected products, software, and workflows.