{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0814","id":"T0814","name":"Denial of Service","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0814","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"18cf279fd322de216f2893f3d0caa73f1a523362090ceaa1a59d12d7c81219fb","description":"Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality. Examples of DoS attacks include overwhelming the target device with a high volume of requests in a short time period and sending the target device a request it does not know how to handle. Disrupting device state may temporarily render it unresponsive, possibly lasting until a reboot can occur. When placed in this state, devices may be unable to send and receive requests, and may not perform expected response functions in reaction to other events in the environment. \n\nSome ICS devices are particularly sensitive to DoS events, and may become unresponsive in reaction to even a simple ping sweep. Adversaries may also attempt to execute a Permanent Denial-of-Service (PDoS) against certain devices, such as in the case of the BrickerBot malware. (Citation: ICS-CERT April 2017) \n\nAdversaries may exploit a software vulnerability to cause a denial of service by taking advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in software that can be used to cause a denial of service condition. \n\nAdversaries may have prior knowledge about industrial protocols or control devices used in the environment through [Remote System Information Discovery](https://attack.mitre.org/techniques/T0888). There are examples of adversaries remotely causing a [Device Restart/Shutdown](https://attack.mitre.org/techniques/T0816) by exploiting a vulnerability that induces uncontrolled resource consumption. (Citation: ICS-CERT August 2018) (Citation: Common Weakness Enumeration January 2019) (Citation: MITRE March 2018) ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0814","external_id":"T0814"},{"source_name":"Common Weakness Enumeration January 2019","description":"Common Weakness Enumeration 2019, January 03 CWE-400: Uncontrolled Resource Consumption Retrieved. 2019/03/14 ","url":"http://cwe.mitre.org/data/definitions/400.html"},{"source_name":"ICS-CERT April 2017","description":"ICS-CERT 2017, April 18 CS Alert (ICS-ALERT-17-102-01A) BrickerBot Permanent Denial-of-Service Attack Retrieved. 2019/10/24 ","url":"https://www.us-cert.gov/ics/alerts/ICS-ALERT-17-102-01A"},{"source_name":"ICS-CERT August 2018","description":"ICS-CERT 2018, August 27 Advisory (ICSA-15-202-01) - Siemens SIPROTEC Denial-of-Service Vulnerability Retrieved. 2019/03/14 ","url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01"},{"source_name":"MITRE March 2018","description":"MITRE 2018, March 22 CVE-2015-5374 Retrieved. 2019/03/14 ","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5374"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0107","name":"Process History/Live Data","page":"telemetry/DC0107/","kind":"attack_component","category":"Industrial operations and physical process","description":"Time-series measurements of an industrial process, including historical and live values.","collection_focus":"Export historian/process tags with engineering units, quality and source timestamps; define expected sample rate and compare an independent signal.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["tag","value","unit","quality"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0107","collector":"illustrative-lab-collector","observation":{"tag":"LAB.TankLevel","value":42,"unit":"percent","quality":"good"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"attack_component","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."},{"id":"DC0033","name":"Process Termination","page":"telemetry/DC0033/","kind":"attack_component","category":"Endpoint activity","description":"Termination of a process, correlated to its earlier creation.","collection_focus":"Collect Sysmon ProcessTerminate (5) and join on ProcessGuid; do not assume every provider records an exit code.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","process_id","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0033","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","process_id":4200,"action":"terminate"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0041","name":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component","category":"Host state and inventory","description":"Service configuration and current state at observation time.","collection_focus":"Inventory service name, executable, startup mode, owner and status using supported OS APIs; compare successive snapshots.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["service","executable","start_mode","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"ics/T0814","id":"T0814","name":"Denial of Service","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0814","technique_page":"techniques/ics/T0814/","page":"detections/ics/T0814/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0723","name":"Detection of Denial of Service","url":"https://attack.mitre.org/detectionstrategies/DET0723","stix_id":"x-mitre-detection-strategy--08c090e3-c56f-4a8b-80f6-307a1daf46ea","relationship_id":"relationship--23564002-f836-4da6-a083-e086a606f0eb","description":"","analytics":[{"id":"AN1856","name":"Analytic 1856","guidance":"Real-time network monitoring identifies a sustained spike in malformed or high-volume Industrial Control System (ICS) protocol traffic directed at a single field device from a source not in the approved control server list, immediately followed by that device dropping out of the supervisory poll cycle. Documented precedent: Sandworm's Industroyer malware sent a crafted 18-byte proprietary User Datagram Protocol (UDP) packet to port 50000 on Siemens Protection Technology (SIPROTEC) relays (CVE-2015-5374), causing the device to hang and require a manual reboot. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.","url":"https://attack.mitre.org/detectionstrategies/DET0723#AN1856","platforms":["Embedded"],"tuning":[{"field":"CPUUtilizationThreshold","description":"Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic."},{"field":"DoSConnectionThreshold","description":"Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate."},{"field":"DoSDetectionWindow","description":"Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes."},{"field":"ExpectedPollInterval","description":"Device-specific supervisory poll interval used to determine what counts as a process historian gap."},{"field":"InterfaceErrorThreshold","description":"Deviation from baseline interface error/discard rate, tuned against historical interface health data."},{"field":"MalformedPacketThreshold","description":"Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"netflow:ipfix","channel":"IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection rate to device_ip exceeds Denial of Service (DoS) threshold per minute from single or distributed sources","platforms":["Embedded"],"analytic_id":"AN1856","source_url":"https://attack.mitre.org/detectionstrategies/DET0723#AN1856","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0107","component":"Process History/Live Data","name":"operationaldb:ProcessHistory","channel":"no new process value recorded for device_ip within 1.5x expected poll interval immediately following a flood alert","platforms":["Embedded"],"analytic_id":"AN1856","source_url":"https://attack.mitre.org/detectionstrategies/DET0723#AN1856","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0107/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"malformed Protocol Data Unit (PDU) rate to device_ip exceeds threshold within detection window from source not in approved Supervisory Control and Data Acquisition (SCADA) server list","platforms":["Embedded"],"analytic_id":"AN1856","source_url":"https://attack.mitre.org/detectionstrategies/DET0723#AN1856","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0038","component":"Application Log Content","name":"scada:applog","channel":"device communication-loss alarm generated within detection window of a corresponding network flood alert","platforms":["Embedded"],"analytic_id":"AN1856","source_url":"https://attack.mitre.org/detectionstrategies/DET0723#AN1856","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN2121","name":"Analytic 2121","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) Linux service process (historian daemon, Open Platform Communications (OPC) gateway) being killed or crashing following a sustained high-rate inbound connection pattern recorded by network monitoring, correlated with daemon log entries indicating connection limit exhaustion or out-of-memory conditions. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.","url":"https://attack.mitre.org/detectionstrategies/DET0723#AN2121","platforms":["Linux"],"tuning":[{"field":"CPUUtilizationThreshold","description":"Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic."},{"field":"DoSConnectionThreshold","description":"Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate."},{"field":"DoSDetectionWindow","description":"Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes."},{"field":"ExpectedPollInterval","description":"Device-specific supervisory poll interval used to determine what counts as a process historian gap."},{"field":"InterfaceErrorThreshold","description":"Deviation from baseline interface error/discard rate, tuned against historical interface health data."},{"field":"MalformedPacketThreshold","description":"Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline."}],"log_sources":[{"component_id":"DC0033","component":"Process Termination","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) service process terminated (SIGKILL/SIGSEGV) following high-rate inbound connections recorded in netflow within the same window","platforms":["Linux"],"analytic_id":"AN2121","source_url":"https://attack.mitre.org/detectionstrategies/DET0723#AN2121","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0033/"},{"component_id":"DC0038","component":"Application Log Content","name":"syslog:daemon","channel":"Industrial Control Systems (ICS) daemon log entry indicating connection limit exceeded, out of memory, or watchdog timeout","platforms":["Linux"],"analytic_id":"AN2121","source_url":"https://attack.mitre.org/detectionstrategies/DET0723#AN2121","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN2168","name":"Analytic 2168","guidance":"Real-time monitoring of switch/router interface counters identifies a sudden spike in discarded or errored packets on an Industrial Control System (ICS)-facing interface combined with Central Processing Unit (CPU) utilization climbing above baseline, correlated with loss of reachability to downstream field devices on that segment within the same window. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.","url":"https://attack.mitre.org/detectionstrategies/DET0723#AN2168","platforms":["Network Devices"],"tuning":[{"field":"CPUUtilizationThreshold","description":"Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic."},{"field":"DoSConnectionThreshold","description":"Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate."},{"field":"DoSDetectionWindow","description":"Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes."},{"field":"ExpectedPollInterval","description":"Device-specific supervisory poll interval used to determine what counts as a process historian gap."},{"field":"InterfaceErrorThreshold","description":"Deviation from baseline interface error/discard rate, tuned against historical interface health data."},{"field":"MalformedPacketThreshold","description":"Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"netflow:ipfix","channel":"IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): flow volume to Industrial Control Systems (ICS) device subnet exceeds Denial of Service (DoS) flow threshold per minute","platforms":["Network Devices"],"analytic_id":"AN2168","source_url":"https://attack.mitre.org/detectionstrategies/DET0723#AN2168","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0038","component":"Application Log Content","name":"networkdevice:snmp","channel":"ifInErrors or ifOutDiscards rate exceeds baseline combined with cpu5min exceeding utilization threshold","platforms":["Network Devices"],"analytic_id":"AN2168","source_url":"https://attack.mitre.org/detectionstrategies/DET0723#AN2168","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN2268","name":"Analytic 2268","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) Windows service (Open Platform Communications (OPC) server, historian, Supervisory Control and Data Acquisition (SCADA) polling service) consuming abnormal Central Processing Unit (CPU)/memory resources and becoming unresponsive following receipt of a high volume of connections to its application port, correlated with watchdog timeout or service crash events. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.","url":"https://attack.mitre.org/detectionstrategies/DET0723#AN2268","platforms":["Windows"],"tuning":[{"field":"CPUUtilizationThreshold","description":"Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic."},{"field":"DoSConnectionThreshold","description":"Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate."},{"field":"DoSDetectionWindow","description":"Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes."},{"field":"ExpectedPollInterval","description":"Device-specific supervisory poll interval used to determine what counts as a process historian gap."},{"field":"InterfaceErrorThreshold","description":"Deviation from baseline interface error/discard rate, tuned against historical interface health data."},{"field":"MalformedPacketThreshold","description":"Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"Microsoft-Windows-Sysmon/Operational Event ID 3 NetworkConnect: inbound connection rate to Industrial Control Systems (ICS) application port exceeds threshold per minute from unexpected sources","platforms":["Windows"],"analytic_id":"AN2268","source_url":"https://attack.mitre.org/detectionstrategies/DET0723#AN2268","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0041","component":"Service Metadata","name":"WinEventLog:System","channel":"EventCode=7034, 7036 for Industrial Control Systems (ICS) service within detection window of connection flood","platforms":["Windows"],"analytic_id":"AN2268","source_url":"https://attack.mitre.org/detectionstrategies/DET0723#AN2268","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0107","name":"Process History/Live Data","tag":"Process History/Live Data","page":"telemetry/DC0107/","kind":"attack_component"},{"id":"DC0033","name":"Process Termination","tag":"Process Termination","page":"telemetry/DC0033/","kind":"attack_component"},{"id":"DC0041","name":"Service Metadata","tag":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0093","name":"Backdoor.Oldrea","url":"https://attack.mitre.org/software/S0093","kind":"malware","description":"The [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) payload has caused multiple common OPC platforms to intermittently crash. This could cause a denial of service effect on applications reliant on OPC communications. (Citation: ICS-CERT August 2018)","relationship_id":"relationship--d90aeeb6-3686-483a-8403-6514ecfe1a50","references":[{"source_name":"ICS-CERT August 2018","description":"ICS-CERT 2018, August 22 Advisory (ICSA-14-178-01) Retrieved. 2019/04/01 ","url":"https://ics-cert.us-cert.gov/advisories/ICSA-14-178-01"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"The [Industroyer](https://attack.mitre.org/software/S0604) SIPROTEC DoS module exploits the CVE-2015-5374 vulnerability in order to render a Siemens SIPROTEC device unresponsive. Once this vulnerability is successfully exploited, the target device stops responding to any commands until it is rebooted manually. (Citation: Anton Cherepanov, ESET June 2017) Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP. The UDP packet contains the following 18 byte payload: 0x11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E. (Citation: Anton Cherepanov, ESET June 2017)","relationship_id":"relationship--50c20664-75dc-451e-b026-67b1d309e4b5","references":[{"source_name":"Anton Cherepanov, ESET June 2017","description":"Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}]},{"id":"S1006","name":"PLC-Blaster","url":"https://attack.mitre.org/software/S1006","kind":"malware","description":"The execution on the PLC can be stopped by violating the cycle time limit. The [PLC-Blaster](https://attack.mitre.org/software/S1006) implements an endless loop triggering an error condition within the PLC with the impact of a DoS. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)","relationship_id":"relationship--535c5160-17e0-44eb-9f4b-1a8e216b56a2","references":[{"source_name":"Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016","description":"Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ","url":"https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"}]},{"id":"S1157","name":"Fuxnet","url":"https://attack.mitre.org/software/S1157","kind":"malware","description":"[Fuxnet](https://attack.mitre.org/software/S1157) shut down remote access services such as SSH, HTTP, telnet, and SNMP to a device along with deleting the routing table for routing devices to inhibit system accessibility and communication.(Citation: Claroty Fuxnet 2024)","relationship_id":"relationship--a6277ff6-9cdf-484f-a902-3f9442039905","references":[{"source_name":"Claroty Fuxnet 2024","description":"Team82. (2024, April 12). Unpacking the Blackjack Group's Fuxnet Malware. Retrieved September 11, 2024.","url":"https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"}]}],"actors":[],"mitigations":[{"id":"M0815","name":"Watchdog Timers","url":"https://attack.mitre.org/mitigations/M0815","kind":"course-of-action","description":"System and process restarts should be performed when a timeout condition occurs.\n","relationship_id":"relationship--5d0a7979-0420-4fd1-b5ad-cb5565cbdf9d","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0888":"/ttp-simulation/techniques/ics/T0888/","T0816":"/ttp-simulation/techniques/ics/T0816/","T0814":"/ttp-simulation/techniques/ics/T0814/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0814","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0107","collector":"illustrative-lab-collector","observation":{"tag":"LAB.TankLevel","value":42,"unit":"percent","quality":"good"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0033","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","process_id":4200,"action":"terminate"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}}]}}