MITRE ATT&CK for ICS Guide: Tactics, v20 Changes and Using the Matrix to Defend OT

Industrial attacks end in physical consequences, loss of control, loss of view, damage and unsafe conditions, and the Enterprise ATT&CK matrix was never designed to describe those steps. MITRE ATT&CK for ICS is the separate knowledge base for adversary behaviour against industrial control systems: 12 tactics, including two that exist only in ICS, Inhibit Response Function and Impair Process Control, plus an asset model, ICS-specific mitigations and, from v20, detection strategies with analytics written for OT telemetry. This guide explains how the matrix is structured, what changed in ATT&CK v20, and how asset owners can use it for threat modelling, detection coverage, purchasing and incident analysis. It is for OT security engineers, control system owners, SOC teams covering OT and threat intelligence analysts. The broader OT programme is covered in the OT Security Guide; this page goes deeper on the framework itself.

Key takeaways

• It models the process, not just the network. ATT&CK for ICS describes how attackers move from IT footholds to engineering workstations, controllers and field devices, and then how they stop safety and response functions and change the physical process.
• Two tactics have no Enterprise equivalent. Inhibit Response Function (TA0107) and Impair Process Control (TA0106) hold the techniques that separate an OT intrusion from an IT one, such as Alarm Suppression and Modify Parameter.
• v20 changed IDs you may already use. Default and hardcoded credentials, firmware modification, blocked and unauthorised messages and serial blocking moved to new T16xx and T17xx IDs; rule tags and coverage maps that use the old T08xx IDs need remapping.
• Detection now has a home. The v20 dataset carries 106 ICS detection strategies with 302 analytics that reference process historian data, industrial protocol content and alarm events, not just Windows logs.
• Campaigns show where to start. The 2026 U.S. Water Utilities Attacks campaign (C0066) and the Unitronics Defacement Campaign (C0031) both began with internet-accessible controllers and default or weak credentials, the cheapest techniques to remove.

What ATT&CK for ICS is and how it differs from Enterprise

ATT&CK for ICS is a domain of MITRE ATT&CK, published alongside Enterprise and Mobile and versioned with them (the live matrix is at v20). Its scope is the industrial control system layer: controllers, safety systems, HMIs, historians, engineering workstations and the networks and protocols between them. It deliberately overlaps with Enterprise at the edges, because most real OT intrusions start in the corporate network or through remote access, but its techniques describe what happens once the adversary reaches systems that monitor or control a physical process.

The asset model is the most useful difference for owners. ATT&CK for ICS defines asset types such as Programmable Logic Controller, Human-Machine Interface, Safety Controller, Data Historian, Workstation (the engineering workstation), Remote Terminal Unit, Intelligent Electronic Device, Jump Host and VPN Server, and links techniques to the assets they target. That lets a site map its own asset inventory straight onto the matrix.

The 12 tactics

The live v20 matrix lists the tactics in the order below; the counts are parent techniques shown on the matrix page.

Inhibit Response Function and Impair Process Control

• Inhibit Response Function: techniques that stop safety, protection, quality assurance and operator intervention from working: suppressing or modifying alarms, stopping services, blocking command or reporting messages, changing device credentials so operators are locked out, and restarting or shutting devices down. It is the OT counterpart of disabling defences, but the "defence" is often a protection relay or a safety instrumented system. See the ATT&CK for ICS Inhibit Response Function Tactic Guide.
• Impair Process Control: techniques that manipulate the process itself: writing out-of-range setpoints, forcing I/O values, sending unauthorised command or reporting messages, and modifying firmware. See the ATT&CK for ICS Impair Process Control Tactic Guide.

What changed in ATT&CK v20

The v20 ICS dataset shows a group of older techniques as revoked and replaced by new IDs that use sub-techniques, so that, for example, command and reporting variants sit under one parent. Remap detection rule tags, threat reports and coverage heat maps that still carry the left-hand IDs.

• New execution coverage: T1701 Command and Scripting Interpreter, with sub-techniques for PowerShell, Windows Command Shell, Unix Shell, Visual Basic, Python and JavaScript, gives ICS its own entry for interpreter abuse on OT hosts. Earlier ICS entries such as Command-Line Interface (T0807) and Scripting (T0853) are marked deprecated in the dataset. See the T1059 Command and Scripting Interpreter Defensive Guide for the Enterprise view.
• Detection strategies: each technique now links to a detection strategy with platform analytics and named log sources, including operationaldb:ProcessHistory, operationaldb:AlarmEvent, decoded industrial protocol content from network monitoring, asset inventory program hashes and vendor device logs.
• New campaign: the 2026 U.S. Water Utilities Attacks (C0066) were added, described below.

Using the matrix: threat modelling and coverage

1. Map assets first: tag every inventory entry with its ATT&CK for ICS asset type. This turns the matrix into a list of techniques that apply to your site and removes the ones that do not. See the OT Asset Visibility Guide.
2. Pick adversaries that fit your sector: use the campaigns and groups relevant to your sector (water, electricity, oil and gas, manufacturing) to choose a starting technique set, rather than trying to cover all 104 entries at once.
3. Score each technique on three columns: can we prevent it, can we see it, can we respond to it safely. Use the ATT&CK mitigation IDs for the first column and the detection strategy log sources for the second.
4. Prioritise the cheap, high-value cells: Internet Accessible Device, Insecure Credentials, External Remote Services and Modify Program usually come first because they are both common and fixable.
5. Validate safely: test detections on a lab, simulator or digital twin, never by sending live writes to production controllers. See the Safe Active Scanning and Testing in OT Guide.
6. Review annually and on each ATT&CK release: remap revoked IDs, add new campaigns, and roll back any detection that caused operational disruption by returning it to alert-only mode.

The method for scoring and visualising coverage is the same as for Enterprise; see the MITRE ATT&CK Coverage Mapping Guide.

Detection engineering with ICS analytics

The v20 ICS analytics are written around OT telemetry and an explicit operational-fidelity gate: alert only when the observed action is outside what the asset's documented role permits. That matters because many "malicious" ICS actions, such as a program download or a setpoint write, are also normal engineering work.

See the OT Network Security Monitoring Guide and the ATT&CK Detection Strategies and Analytics Guide.

Campaigns as threat intelligence

For the water campaign, the FBI and EPA public service announcement of 30 July 2026 reported incidents at Water and Wastewater Sector utilities in at least seven states, effects including loss of pressure and flooding, and modified project files at one organisation. Its mitigations include removing PLCs from direct internet exposure, securing cellular modems and reviewing their logs, unique device passwords, ACLs that allow only authorised control traffic, keeping key switches in run mode except during changes, practising manual operation, and verifying project files against known-good logic. For Unitronics, CISA advisory AA23-335A reported the actors authenticating with default or no passwords over default TCP port 20256 and recommended replacing all default passwords on PLCs and HMIs. See the ICS Malware History Guide and the Pro-Russia Hacktivists Targeting OT Guide.

Where identity fits

Insecure Credentials (T1694), Valid Accounts (T0859), Change Credential (T0892) and External Remote Services (T0822) put identity at the start and the middle of most ICS kill chains. Controllers and HMIs often have shared or default passwords, vendor remote access uses long-lived accounts, and engineering software stores project passwords. Inventory every device and remote access credential, remove defaults, give vendors named, time-bound access through a jump host with MFA (M0932), and treat a device credential change as a security event. See the OT and ICS Identity and Access Guide and the OT Remote Access Guide.

Lessons from incidents

• IT compromise can stop OT without touching it: in the Colonial Pipeline ransomware attack, the physical impact came from the company's precautionary shutdown of the pipeline, not from attackers reaching pipeline controls; entry was a legacy VPN account without MFA. In ATT&CK for ICS terms the outcome is Loss of Productivity and Revenue (T0828), and the planning lesson is to know which IT dependencies force an OT shutdown.
• Exposure plus defaults is enough: both C0066 and C0031 needed no exploit, only internet-reachable controllers and weak or default credentials.

Common failure patterns

• Using only the Enterprise matrix: coverage maps that stop at the engineering workstation and never score Inhibit Response Function or Impair Process Control.
• Stale IDs: detection content and reports tagged with revoked T08xx IDs that no longer resolve in v20 tooling.
• Alerting on normal engineering: rules for program downloads or setpoint writes without the approved-source and change-window gates, which operators quickly learn to ignore.
• Testing on production: emulating ICS techniques against live controllers instead of a lab or simulator.
• Counting techniques instead of consequences: treating every cell equally rather than prioritising those that lead to Loss of Safety or Loss of Control at your site.

Framework mapping

Practitioner checklist

• Tag every OT asset in the inventory with its ATT&CK for ICS asset type.
• Remap detection rules, reports and heat maps from revoked T08xx IDs to the v20 IDs.
• Score coverage for Inhibit Response Function and Impair Process Control explicitly, not only Initial Access and Lateral Movement.
• Confirm no PLC, HMI or cellular gateway is reachable from the internet and that no default credentials remain.
• Collect historian, alarm event and decoded protocol telemetry and build the approved-source and change-window gates into ICS detections.
• Verify controller program hashes against known-good versions on a schedule.
• Test new detections on a lab or simulator and start them in alert-only mode.
• Review the matrix and campaigns at each ATT&CK release and after each major sector advisory.

Standards and references

• MITRE ATT&CK: ICS Matrix
• MITRE ATT&CK: 2026 U.S. Water Utilities Attacks (C0066)
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• ISA: ISA/IEC 62443 Series of Standards
• FBI and EPA: Public Service Announcement I-073026-PSA on attacks against internet-facing PLCs at water utilities
• CISA: AA23-335A IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: OT Security Guide · MITRE ATT&CK Guide for Defenders · PLC Security Guide · OT Incident Response Guide