{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0831","id":"T0831","name":"Manipulation of Control","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0831","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"5f5b364b54bbdf9bf17cdc49217ec4e47dfea2a761aef437ad4e17d8334b4fee","description":"Adversaries may manipulate physical process control within the industrial environment. Methods of manipulating control can include changes to set point values, tags, or other parameters. Adversaries may manipulate control systems devices or possibly leverage their own, to communicate with and command physical control processes. The duration of manipulation may be temporary or longer sustained, depending on operator detection.   \n\nMethods of Manipulation of Control include: \n\n* Man-in-the-middle  \n* Spoof command message \n* Changing setpoints  \n\nA Polish student used a remote controller device to interface with the Lodz city tram system in Poland. (Citation: John Bill May 2017) (Citation: Shelley Smith February 2008) (Citation: Bruce Schneier January 2008) Using this remote, the student was able to capture and replay legitimate tram signals. As a consequence, four trams were derailed and twelve people injured due to resulting emergency stops. (Citation: Shelley Smith February 2008) The track controlling commands issued may have also resulted in tram collisions, a further risk to those on board and nearby the areas of impact. (Citation: Bruce Schneier January 2008)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0831","external_id":"T0831"},{"source_name":"Bruce Schneier January 2008","description":"Bruce Schneier 2008, January 17 Hacking Polish Trams Retrieved. 2019/10/17 ","url":"https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html"},{"source_name":"John Bill May 2017","description":"John Bill 2017, May 12 Hacked Cyber Security Railways Retrieved. 2019/10/17 ","url":"https://www.londonreconnections.com/2017/hacked-cyber-security-railways/"},{"source_name":"Shelley Smith February 2008","description":"Shelley Smith 2008, February 12 Teen Hacker in Poland Plays Trains and Derails City Tram System Retrieved. 2019/10/17 ","url":"https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/"}],"platforms":["None"],"environments":["ics-ot"],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","parent":null,"children":[],"telemetry":[{"id":"proposed-controller-setpoint-and-configuration-audit","name":"Controller setpoint and configuration audit","page":"telemetry/proposed-controller-setpoint-and-configuration-audit/","kind":"proposed_input","category":"Industrial operations and physical process","description":"Recorded changes to controller parameters, setpoints or configuration.","collection_focus":"Enable vendor-supported audit where safe; retain actor, parameter, before/after values and approved change record.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["asset_id","parameter","before","after","change_ticket"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-controller-setpoint-and-configuration-audit","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","parameter":"LAB.target_level","before":40,"after":42,"change_ticket":"LAB-42"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"proposed_input","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."},{"id":"proposed-independent-physical-process-measurements","name":"Independent physical process measurements","page":"telemetry/proposed-independent-physical-process-measurements/","kind":"proposed_input","category":"Industrial operations and physical process","description":"A separate physical measurement used to check values reported by the control system.","collection_focus":"Use an independently powered/read sensor approved for the fixture; document calibration and independence assumptions.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["tag","independent_value","reported_value","unit"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-independent-physical-process-measurements","collector":"illustrative-lab-collector","observation":{"tag":"LAB.TankLevel","independent_value":42.2,"reported_value":42,"unit":"percent"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"proposed_input","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."}],"detection":{"key":"ics/T0831","id":"T0831","name":"Manipulation of Control","domain":"ics","platforms":["None"],"environments":["ics-ot"],"source_url":"https://attack.mitre.org/techniques/T0831","technique_page":"techniques/ics/T0831/","page":"detections/ics/T0831/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0747","name":"Detection of Manipulation of Control","url":"https://attack.mitre.org/detectionstrategies/DET0747","stix_id":"x-mitre-detection-strategy--ae24274b-0e20-451e-a883-6eeb0e8e7d00","relationship_id":"relationship--20031e48-2258-4901-ac21-bffd7191e931","description":"","analytics":[{"id":"AN1880","name":"Analytic 1880","guidance":"No standard detection method currently exists for this technique.","url":"https://attack.mitre.org/detectionstrategies/DET0747#AN1880","platforms":["None"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[{"id":"proposed-controller-setpoint-and-configuration-audit","name":"Controller setpoint and configuration audit","tag":"Proposed: Controller setpoint and configuration audit","page":"telemetry/proposed-controller-setpoint-and-configuration-audit/","kind":"proposed_input"},{"id":"proposed-independent-physical-process-measurements","name":"Independent physical process measurements","tag":"Proposed: Independent physical process measurements","page":"telemetry/proposed-independent-physical-process-measurements/","kind":"proposed_input"}],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) can reprogram a PLC and change critical parameters in such a way that legitimate commands can be overridden or intercepted. In addition, Stuxnet can apply inappropriate command sequences or parameters to cause damage to property. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--c6520346-fe47-44ce-af75-d99004ac2977","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604) toggles breakers to the open state utilizing unauthorized command messages. (Citation: Anton Cherepanov, ESET June 2017)","relationship_id":"relationship--7c3b65e8-e8b7-4c3b-b27b-e216986d8976","references":[{"source_name":"Anton Cherepanov, ESET June 2017","description":"Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}]}],"actors":[],"mitigations":[{"id":"M0802","name":"Communication Authenticity","url":"https://attack.mitre.org/mitigations/M0802","kind":"course-of-action","description":"Protocols used for control functions should provide authenticity through MAC functions or digital signatures. If not, utilize bump-in-the-wire devices or VPNs to enforce communication authenticity between devices that are not capable of supporting this (e.g., legacy controllers, RTUs).\n","relationship_id":"relationship--b628d878-4f35-4580-8d42-26984d13821e","references":[]},{"id":"M0810","name":"Out-of-Band Communications Channel","url":"https://attack.mitre.org/mitigations/M0810","kind":"course-of-action","description":"Utilize out-of-band communication to validate the integrity of data from the primary channel.\n","relationship_id":"relationship--520aad6a-2483-45bc-a172-2417137f6ca0","references":[]},{"id":"M0953","name":"Data Backup","url":"https://attack.mitre.org/mitigations/M0953","kind":"course-of-action","description":"Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans  (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.\n","relationship_id":"relationship--578117b2-0f4b-4d75-a2dc-3ee45976e616","references":[{"source_name":"Department of Homeland Security October 2009","description":"Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0831":"/ttp-simulation/techniques/ics/T0831/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0831","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-controller-setpoint-and-configuration-audit","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","parameter":"LAB.target_level","before":40,"after":42,"change_ticket":"LAB-42"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-independent-physical-process-measurements","collector":"illustrative-lab-collector","observation":{"tag":"LAB.TankLevel","independent_value":42.2,"reported_value":42,"unit":"percent"}}]}}