MITRE ATT&CK for ICS T0831 Manipulation of Control: Detection and Response in OT

Manipulation of Control (T0831) is the point where an OT intrusion stops being about data and starts moving physical equipment: breakers open, setpoints change, drives speed up or slow down. MITRE ATT&CK for ICS places it under the Impact tactic and describes adversaries manipulating physical process control, with methods that include man-in-the-middle, spoofed command messages and changed setpoints, for a duration that may be short or sustained depending on when operators notice. This guide is for OT security engineers, control engineers, SCADA administrators and incident responders. It covers how T0831 relates to its neighbouring techniques, the recorded cases, what you can actually monitor, how to apply the three ATT&CK mitigations, and how to respond without making the process less safe. For the wider matrix see the MITRE ATT&CK for ICS Guide and the ATT&CK for ICS Impact Tactic Guide.

Key takeaways

• T0831 is an outcome, not a method. ATT&CK lists no platform for it ("None"); you detect and prevent the means, such as unauthorised command messages, adversary-in-the-middle and parameter changes.
• Every recorded case used legitimate control paths. Sandworm opened breakers through the HMI in 2015, Industroyer sent its own command messages, and Stuxnet changed PLC parameters, so "valid command from the wrong source" is the core detection problem.
• ATT&CK states there is no standard detection for the technique itself. Its detection strategy DET0747 says so, which makes a baseline of who commands what, from where and when your main tool.
• The mitigations target integrity of commands and the ability to recover. Communication Authenticity (M0802), an Out-of-Band Communications Channel (M0810) and Data Backup (M0953) are the three ATT&CK lists.
• Response is a process safety decision first. Operations decides whether to move to manual or local control; security supports that decision and preserves evidence, never the other way round.

What T0831 covers and how it differs from nearby techniques

ATT&CK v20 describes adversaries manipulating physical process control within the industrial environment, either by using control system devices already present or by bringing their own, to communicate with and command the physical process. The technique sits in the Impact tactic (TA0105) and has no sub-techniques. The methods named in the description are delivered by techniques in other tactics, which is why this page is short on "how" and long on "how to tell".

Use the technique pages for the means: the T1692 Unauthorized Message, T0830 Adversary-in-the-Middle, T0806 Brute Force I/O and T0827 Loss of Control guides. The process-level context is in the ATT&CK for ICS Impair Process Control Tactic Guide.

Real cases recorded by ATT&CK

ATT&CK v20 lists three procedure examples for T0831 and one historic case in the technique description.

• 2015 Ukraine Electric Power Attack (C0028): ATT&CK records that Sandworm Team opened live breakers via remote commands to the HMI, causing blackouts. The attackers used the operators' own tools, so the commands were valid in protocol terms; only their source and timing were wrong.
• Industroyer (S0604): ATT&CK records that it toggles breakers to the open state using unauthorised command messages. Here the malware spoke the substation protocols itself rather than driving the HMI.
• Stuxnet (S0603): ATT&CK records that it can reprogram a PLC and change critical parameters so that legitimate commands are overridden or intercepted, and apply inappropriate command sequences or parameters. Symantec's W32.Stuxnet Dossier describes the PLC code writing frames to frequency converter drives that repeatedly changed the maximum frequency, and so the motor speed.
• Lodz tram system (2008): the ATT&CK description cites a student who used a modified remote control to send track switching signals in Lodz, Poland. ATT&CK records four derailed trams and twelve injuries from the resulting emergency stops. Bruce Schneier's write-up attributes it to the infrared points control being reverse engineered, a reminder that manipulation of control does not need an IT network at all.

The pattern across the cases: three different means (operator tools, protocol injection, controller logic) leading to one outcome. Detection that only watches one of those layers misses the others. For the malware background see the ICS Malware History Guide.

Detecting manipulation of control

ATT&CK's detection strategy DET0747 contains one analytic: "No standard detection method currently exists for this technique." In practice you combine three viewpoints: who issued the command, what the command did to the controller, and what the process actually did.

Making the signals useful

• Build an allowlist of command sources: for each controller, record which hosts are permitted to issue control writes. Any write from elsewhere is high fidelity, because normal OT traffic is predictable.
• Correlate with the maintenance calendar: most legitimate setpoint and logic changes have a work order. Alerts with no matching change ticket are the ones to escalate.
• Watch the physics: a process model or simple range checks on independent measurements catch manipulation even when the command path looks clean, and they are the only check if the view is also manipulated.
• Route alerts to both teams: the control room can confirm in seconds whether an operation was intended; the OT SOC cannot.

For sensor placement and protocol decoding see the OT Network Security Monitoring Guide.

Mitigations: the three ATT&CK lists and how to apply them

1. Communication Authenticity (M0802): ATT&CK advises that protocols used for control functions should provide authenticity through MAC functions or digital signatures, and where they cannot, to use bump-in-the-wire devices or VPNs between devices that cannot support it, such as legacy controllers and RTUs. Prioritise links that cross zones or use radio, cellular or public networks.
2. Out-of-Band Communications Channel (M0810): ATT&CK's text for T0831 is to use out-of-band communication to validate the integrity of data from the primary channel. In practice this means an independent path, such as local indication, a separate telemetry link or field confirmation, to check that a reported state change really happened.
3. Data Backup (M0953): hardened, separated backups and gold-copy images of key systems and configurations, plus exercised incident response plans, so known-good controller logic and HMI servers can be restored quickly. See the OT Backup, Recovery and Golden Image Guide.

Upstream controls reduce the chance an adversary reaches the control path at all. The joint CISA, FBI, EPA and DOE primary mitigations for OT are: remove OT devices from the public internet, change default passwords, secure remote access with a private connection or VPN with phishing-resistant MFA, segment IT and OT with a DMZ, and keep the ability to operate manually with tested recovery plans. The zone and conduit design is in the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide, and controller-level hardening in the PLC Security Guide.

Choosing between options

Where identity fits

The Ukraine case shows why control authority is an identity question. Commands came from legitimate HMIs through remote access, so the control that mattered was who could hold an operator session and from where. Shared operator logins, vendor remote access accounts with standing access and service accounts on SCADA servers that can issue writes are all non-human or shared identities that should be inventoried, owned and limited. Give each vendor named accounts with time-bound access, keep engineering credentials off the corporate directory where possible, and log every session. See the OT Remote Access Guide and the Energy Sector Identity and OT Access Guide.

Safety-aware response

1. Operations decides the safe state: the shift supervisor decides whether to move to local or manual control, isolate a section or shut down, based on process safety. Security advises on which systems are suspect.
2. Confirm the protection layer: check that the safety instrumented system and protective relays are healthy and have not been changed, since the adversary may target them next. See the Safety Instrumented Systems Security Guide.
3. Cut the command source, not the process: disable the suspect remote access path, account or host before blocking control traffic wholesale, because blocking a conduit can also stop legitimate control.
4. Verify field state independently: send staff to confirm breaker, valve and drive positions, because the HMI may be manipulated as well (T0832).
5. Preserve evidence: keep HMI and SCADA logs, historian data, network captures, controller project files read from the device and images of engineering workstations before rebuilding.
6. Restore known-good logic and parameters: compare running programs and setpoints with the approved baseline, restore from gold copies, and return to automatic control only after operations signs off.

The wider process is in the OT Incident Response Guide.

Metrics that show it is working

• Command source coverage: share of critical controllers with a documented allowlist of permitted command sources that is monitored.
• Unexplained control writes: count per month of control writes or setpoint changes with no work order, and share investigated within one shift.
• Baseline freshness: share of controllers whose running logic was compared with the approved project in the last quarter.
• Authenticated links: share of inter-zone and wireless control links protected by message authentication or an authenticated tunnel.
• Manual operation readiness: date of the last exercise in which a critical process area was run in manual or local mode.

Framework mapping

For OT tailoring of these controls see the NIST SP 800-82 OT Security Guide and the IEC 62443 Guide.

Common failure patterns

• Monitoring only for malware: the Ukraine attackers used the operators' own HMIs, so endpoint alerts alone would not have shown the breaker operations as malicious.
• Remote access with full control rights by default: a vendor or support session that can operate equipment when it only needed to read values widens the attack path for no benefit.
• No baseline of controller logic: without a saved approved project, nobody can say whether the running program or setpoints were changed.
• Trusting the HMI during an incident: manipulation of control is often paired with manipulation of view; restoring based on screen values alone can leave the process in a manipulated state.
• Unauthenticated radio and serial links: the Lodz and Maroochy cases both involved control signals sent over radio or infrared paths that accepted whoever spoke the protocol.
• Blocking traffic without operations: a security team that isolates a conduit unilaterally can cause the very loss of control it was trying to prevent.

Practitioner checklist

• Document permitted command sources for each critical controller and alert on control writes from anywhere else.
• Decode OT protocols on conduits between control centre, substations and field sites.
• Correlate setpoint and logic changes with work orders and review unmatched changes every shift.
• Keep approved controller projects and compare running logic against them on a schedule.
• Enable message authentication or authenticated tunnels on inter-zone, radio and cellular control links.
• Make remote and vendor sessions view-only by default and grant control rights per task.
• Keep gold copies of HMI, SCADA and engineering workstation images and test restore time.
• Exercise a manipulation of control scenario jointly with operations, including the decision to go manual.

Standards and references

• MITRE ATT&CK for ICS: Manipulation of Control (T0831)
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
• Symantec: W32.Stuxnet Dossier
• MITRE: Malicious Control System Cyber Security Attack Case Study, Maroochy Water Services, Australia
• Schneier on Security: Hacking Polish Trams

Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · T0827 Loss of Control · OT Security Operations Centre Guide · OT Security Guide