{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0822","id":"T0822","name":"External Remote Services","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0822","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"1f79f8396b8a75293ec393801081520d56d162bfccd8079ef3cd3327e9d9fd28","description":"Adversaries may leverage external remote services as a point of initial access into your network. These services allow users to connect to internal network resources from external locations. Examples are VPNs, Citrix, and other access mechanisms. Remote service gateways often manage connections and credential authentication for these services. (Citation: Daniel Oakley, Travis Smith, Tripwire)\n\nExternal remote services allow administration of a control system from outside the system. Often, vendors and internal engineering groups have access to external remote services to control system networks via the corporate network. In some cases, this access is enabled directly from the internet. While remote access enables ease of maintenance when a control system is in a remote area, compromise of remote access solutions is a liability. The adversary may use these services to gain access to and execute attacks against a control system network. Access to valid accounts is often a requirement. \n\nAs they look for an entry point into the control system network, adversaries may begin searching for existing point-to-point VPN implementations at trusted third party networks or through remote support employee connections where split tunneling is enabled. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0822","external_id":"T0822"},{"source_name":"Daniel Oakley, Travis Smith, Tripwire","description":"Daniel Oakley, Travis Smith, Tripwire   Retrieved. 2018/05/30 ","url":"https://attack.mitre.org/wiki/Technique/T1133"},{"source_name":"Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016","description":"Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems 2016, March 18 Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case Retrieved. 2018/03/27 ","url":"https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt6a77276749b76a40/607f235992f0063e5c070fff/E-ISAC_SANS_Ukraine_DUC_5%5b73%5d.pdf"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0088","name":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component","category":"Host state and inventory","description":"Attributes of existing logon sessions and their association with accounts or hosts.","collection_focus":"Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["session_id","account","host","session_type"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"ics/T0822","id":"T0822","name":"External Remote Services","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0822","technique_page":"techniques/ics/T0822/","page":"detections/ics/T0822/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0803","name":"Detection of External Remote Services","url":"https://attack.mitre.org/detectionstrategies/DET0803","stix_id":"x-mitre-detection-strategy--e9f6c9ad-7368-43e3-9ba1-c9261323a1d1","relationship_id":"relationship--68e0f740-e04d-492c-b735-ce75f86a62f5","description":"","analytics":[{"id":"AN1935","name":"Analytic 1935","guidance":"Real-time monitoring identifies authentication to an external remote access gateway using credentials associated with Industrial Control System (ICS)-role accounts, from a source geolocation or Autonomous System Number (ASN) inconsistent with the account's established usage pattern, immediately followed by that session establishing connectivity into the ICS network zone. Documented in VPNFilter, which specifically targeted routers and network edge devices. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0803#AN1935","platforms":["Network Devices"],"tuning":[{"field":"ApprovedRemoteAccessOrigins","description":"Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected."},{"field":"ExpectedSessionPattern","description":"Baseline of normal session timing/duration for each ICS-role account's remote access usage."},{"field":"RemoteAccessToICSWindow","description":"Time window correlating VPN authentication with subsequent ICS-zone network access."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"netflow:ipfix","channel":"IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address into device subnet within remote access to Industrial Control Systems (ICS) window of the anomalous authentication","platforms":["Network Devices"],"analytic_id":"AN1935","source_url":"https://attack.mitre.org/detectionstrategies/DET0803#AN1935","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0038","component":"Application Log Content","name":"vpn:applog","channel":"session duration or command activity inconsistent with documented vendor support session profiles","platforms":["Network Devices"],"analytic_id":"AN1935","source_url":"https://attack.mitre.org/detectionstrategies/DET0803#AN1935","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0088","component":"Logon Session Metadata","name":"vpn:authlog","channel":"Industrial Control Systems (ICS)-role account authentication from source geolocation/Autonomous System Number (ASN) not in approved remote access origins or outside expected session pattern","platforms":["Network Devices"],"analytic_id":"AN1935","source_url":"https://attack.mitre.org/detectionstrategies/DET0803#AN1935","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"}]},{"id":"AN2224","name":"Analytic 2224","guidance":"Near-real-time connection monitoring identifies connections to Industrial Control System (ICS) field device management ports from Internet Protocol (IP) addresses routed through external remote access infrastructure rather than from within the expected ICS network segments. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows. This analytic is implementable from session/flow metadata (endpoints, ports, protocol/service, timing, bytes); it does not require or claim packet-payload visibility.","url":"https://attack.mitre.org/detectionstrategies/DET0803#AN2224","platforms":["Embedded"],"tuning":[{"field":"ApprovedRemoteAccessOrigins","description":"Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected."},{"field":"ExpectedSessionPattern","description":"Baseline of normal session timing/duration for each ICS-role account's remote access usage."},{"field":"RemoteAccessToICSWindow","description":"Time window correlating VPN authentication with subsequent ICS-zone network access."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Connections","channel":"Connection/session metadata: management-port session to field device originates through external remote-access infrastructure rather than approved internal management path","platforms":["Embedded"],"analytic_id":"AN2224","source_url":"https://attack.mitre.org/detectionstrategies/DET0803#AN2224","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2257","name":"Analytic 2257","guidance":"Real-time monitoring identifies an SSH authentication/session to an ICS Linux asset from a VPN-assigned or remote-access source outside the approved remote-administration baseline. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0803#AN2257","platforms":["Linux"],"tuning":[{"field":"ApprovedRemoteAccessOrigins","description":"Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected."},{"field":"ExpectedSessionPattern","description":"Baseline of normal session timing/duration for each ICS-role account's remote access usage."},{"field":"RemoteAccessToICSWindow","description":"Time window correlating VPN authentication with subsequent ICS-zone network access."}],"log_sources":[{"component_id":"DC0088","component":"Logon Session Metadata","name":"syslog:auth","channel":"Secure Shell (SSH) session from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly","platforms":["Linux"],"analytic_id":"AN2257","source_url":"https://attack.mitre.org/detectionstrategies/DET0803#AN2257","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"}]},{"id":"AN2265","name":"Analytic 2265","guidance":"Real-time monitoring identifies an Industrial Control System (ICS)-role account session originating from a Virtual Private Network (VPN)/remote access connection that subsequently accesses Windows ICS hosts in a pattern inconsistent with documented vendor support session profiles. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0803#AN2265","platforms":["Windows"],"tuning":[{"field":"ApprovedRemoteAccessOrigins","description":"Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected."},{"field":"ExpectedSessionPattern","description":"Baseline of normal session timing/duration for each ICS-role account's remote access usage."},{"field":"RemoteAccessToICSWindow","description":"Time window correlating VPN authentication with subsequent ICS-zone network access."}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"WinEventLog:Security","channel":"Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly","platforms":["Windows"],"analytic_id":"AN2265","source_url":"https://attack.mitre.org/detectionstrategies/DET0803#AN2265","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0088","name":"Logon Session Metadata","tag":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1157","name":"Fuxnet","url":"https://attack.mitre.org/software/S1157","kind":"malware","description":"[Fuxnet](https://attack.mitre.org/software/S1157) initial execution relied on accessing external remote services for victim environments.(Citation: Claroty Fuxnet 2024)","relationship_id":"relationship--66eb9d6f-498b-4a9a-94d3-fe808460bb68","references":[{"source_name":"Claroty Fuxnet 2024","description":"Team82. (2024, April 12). Unpacking the Blackjack Group's Fuxnet Malware. Retrieved September 11, 2024.","url":"https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"}]}],"actors":[],"mitigations":[{"id":"M0918","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M0918","kind":"course-of-action","description":"Consider utilizing jump boxes for external remote access. Additionally, dynamic account management may be used to easily remove accounts when not in use.\n","relationship_id":"relationship--a7fbe555-a61b-4b93-bfb2-8e0dd0d6323e","references":[]},{"id":"M0927","name":"Password Policies","url":"https://attack.mitre.org/mitigations/M0927","kind":"course-of-action","description":"Set and enforce secure password policies for accounts.\n","relationship_id":"relationship--98f1d575-a975-42ae-8b00-2c9e22d560d5","references":[]},{"id":"M0930","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M0930","kind":"course-of-action","description":"Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. Consider a jump server or host into the DMZ for greater access control. Leverage this DMZ or corporate resources for vendor access. (Citation: Keith Stouffer May 2015)\n","relationship_id":"relationship--220140ac-d927-4d86-9335-c04aa6ee3c61","references":[{"source_name":"Keith Stouffer May 2015","description":"Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"}]},{"id":"M0932","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M0932","kind":"course-of-action","description":"Use strong multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials. Be aware of multi-factor authentication interception techniques for some implementations.\n","relationship_id":"relationship--dc35c44a-a90c-48a1-8811-af2618216e42","references":[]},{"id":"M0935","name":"Limit Access to Resource Over Network","url":"https://attack.mitre.org/mitigations/M0935","kind":"course-of-action","description":"Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems.\n","relationship_id":"relationship--2daeeaaa-5b4b-4bb7-a94d-78a5749027ca","references":[]},{"id":"M0936","name":"Account Use Policies","url":"https://attack.mitre.org/mitigations/M0936","kind":"course-of-action","description":"Configure features related to account use like login attempt lockouts, specific login times, and password strength requirements as examples. Consider these features as they relate to assets which may impact safety and availability. (Citation: Keith Stouffer May 2015)\n","relationship_id":"relationship--276aa6a6-e700-470a-8f72-02537ba7be9d","references":[{"source_name":"Keith Stouffer May 2015","description":"Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"}]},{"id":"M0942","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M0942","kind":"course-of-action","description":"Consider removal of remote services which are not regularly in use, or only enabling them when required (e.g., vendor remote access). Ensure all external remote access point (e.g., jump boxes, VPN concentrator) are configured with least functionality, especially the removal of unnecessary services. (Citation: Department of Homeland Security September 2016)\n","relationship_id":"relationship--a847aa03-ea56-47d1-8f4e-f9e0dd9707a0","references":[{"source_name":"Department of Homeland Security September 2016","description":"Department of Homeland Security 2016, September Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0822":"/ttp-simulation/techniques/ics/T0822/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0822","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}