{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0848","id":"T0848","name":"Rogue Master","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0848","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"e564caac7322c06392c0ec06150c08850a6462c6974dc95720cdfca2e08fc0e0","description":"Adversaries may setup a rogue master to leverage control server functions to communicate with outstations. A rogue master can be used to send legitimate control messages to other control system devices, affecting processes in unintended ways. It may also be used to disrupt network communications by capturing and receiving the network traffic meant for the actual master. Impersonating a master may also allow an adversary to avoid detection. \n\nIn the case of the 2017 Dallas Siren incident, adversaries used a rogue master to send command messages to the 156 distributed sirens across the city, either through a single rogue transmitter with a strong signal, or using many distributed repeaters. (Citation: Bastille April 2017) (Citation: Zack Whittaker April 2017)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0848","external_id":"T0848"},{"source_name":"Bastille April 2017","description":"Bastille 2017, April 17 Dallas Siren Attack Retrieved. 2020/11/06 ","url":"https://www.bastille.net/blogs/2017/4/17/dallas-siren-attack"},{"source_name":"Zack Whittaker April 2017","description":"Zack Whittaker 2017, April 12 Dallas' emergency sirens were hacked with a rogue radio signal Retrieved. 2020/11/06 ","url":"https://www.zdnet.com/article/experts-think-they-know-how-dallas-emergency-sirens-were-hacked/"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0110","name":"Asset Inventory","page":"telemetry/DC0110/","kind":"attack_component","category":"Industrial operations and physical process","description":"Inventory of operational assets, identities, roles and network relationships.","collection_focus":"Prefer approved inventory exports and passive discovery; retain model, firmware, owner and observation source. Do not scan a production control network as a default collection step.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["asset_id","role","firmware","source"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0110","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","role":"PLC_fixture","firmware":"lab-1.0","source":"approved_inventory"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"attack_component","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."},{"id":"DC0108","name":"Device Alarm","page":"telemetry/DC0108/","kind":"attack_component","category":"Industrial operations and physical process","description":"Device-generated alarms about equipment or controller state.","collection_focus":"Subscribe to supported device alarm/audit channels; retain code, severity, source asset and acknowledgement/clear times.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["asset_id","alarm_code","severity","active"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0108","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","alarm_code":"LAB_COMM_LOSS","severity":"warning","active":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"attack_component","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"ics/T0848","id":"T0848","name":"Rogue Master","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0848","technique_page":"techniques/ics/T0848/","page":"detections/ics/T0848/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0792","name":"Detection of Rogue Master","url":"https://attack.mitre.org/detectionstrategies/DET0792","stix_id":"x-mitre-detection-strategy--9ad17e7a-5920-42ac-9bf4-545b99162640","relationship_id":"relationship--6797d89b-c631-4a45-90b8-7da2c703b6e7","description":"","analytics":[{"id":"AN1924","name":"Analytic 1924","guidance":"Real-time monitoring identifies Industrial Control System (ICS) master-role command traffic originating from a source not in the approved control server inventory, directed at multiple field devices in a pattern consistent with control-server behavior. Documented in Maroochy Water Services (falsified PDS/station addresses to impersonate the master) and the 2017 Dallas Siren incident (rogue radio transmitter to 156 sirens). OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.","url":"https://attack.mitre.org/detectionstrategies/DET0792#AN1924","platforms":["Embedded"],"tuning":[{"field":"ApprovedSCADAServers","description":"IP/identity allowlist of legitimate master/control server systems."},{"field":"RegisteredMasterAddresses","description":"Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP."},{"field":"RogueMasterTimeWindow","description":"Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event."}],"log_sources":[{"component_id":"DC0110","component":"Asset Inventory","name":"assetinventory:MasterAddress","channel":"command traffic uses master/station address not in registered master addresses","platforms":["Embedded"],"analytic_id":"AN1924","source_url":"https://attack.mitre.org/detectionstrategies/DET0792#AN1924","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0110/"},{"component_id":"DC0108","component":"Device Alarm","name":"operationaldb:AlarmEvent","channel":"device receives commands from two distinct master identities within a short window","platforms":["Embedded"],"analytic_id":"AN1924","source_url":"https://attack.mitre.org/detectionstrategies/DET0792#AN1924","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0108/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"write/control command traffic from source not in approved Supervisory Control and Data Acquisition (SCADA) servers directed at multiple distinct device IPs within rogue master time window","platforms":["Embedded"],"analytic_id":"AN1924","source_url":"https://attack.mitre.org/detectionstrategies/DET0792#AN1924","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN2151","name":"Analytic 2151","guidance":"Real-time monitoring identifies a Linux process opening Industrial Control System (ICS) protocol master connections to multiple field device Internet Protocol (IP) addresses, from a host that is not the authorized Supervisory Control and Data Acquisition (SCADA) server. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.","url":"https://attack.mitre.org/detectionstrategies/DET0792#AN2151","platforms":["Linux"],"tuning":[{"field":"ApprovedSCADAServers","description":"IP/identity allowlist of legitimate master/control server systems."},{"field":"RegisteredMasterAddresses","description":"Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP."},{"field":"RogueMasterTimeWindow","description":"Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscalls show a host outside the approved SCADA/master set opening ICS-protocol connections to multiple field devices","platforms":["Linux"],"analytic_id":"AN2151","source_url":"https://attack.mitre.org/detectionstrategies/DET0792#AN2151","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN2178","name":"Analytic 2178","guidance":"Real-time monitoring identifies a new device appearing on the Industrial Control System (ICS) network with network behavior consistent with an ICS master station, with a Media Access Control (MAC) address not in the approved device inventory. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.","url":"https://attack.mitre.org/detectionstrategies/DET0792#AN2178","platforms":["Network Devices"],"tuning":[{"field":"ApprovedSCADAServers","description":"IP/identity allowlist of legitimate master/control server systems."},{"field":"RegisteredMasterAddresses","description":"Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP."},{"field":"RogueMasterTimeWindow","description":"Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"netflow:ipfix","channel":"IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new device Media Access Control (MAC) address on Industrial Control Systems (ICS) network generating ICS master-pattern traffic such as polling multiple device Internet Protocol (IP) addresses on ICS protocol ports","platforms":["Network Devices"],"analytic_id":"AN2178","source_url":"https://attack.mitre.org/detectionstrategies/DET0792#AN2178","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2278","name":"Analytic 2278","guidance":"Real-time monitoring identifies Industrial Control System (ICS) protocol master-role traffic originating from a Windows host that is not the authorized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) server. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.","url":"https://attack.mitre.org/detectionstrategies/DET0792#AN2278","platforms":["Windows"],"tuning":[{"field":"ApprovedSCADAServers","description":"IP/identity allowlist of legitimate master/control server systems."},{"field":"RegisteredMasterAddresses","description":"Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP."},{"field":"RogueMasterTimeWindow","description":"Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3 unexpected Windows host opening Industrial Control Systems (ICS) protocol connections to multiple field device Internet Protocol (IP) addresses in polling pattern characteristic of master station","platforms":["Windows"],"analytic_id":"AN2278","source_url":"https://attack.mitre.org/detectionstrategies/DET0792#AN2278","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0110","name":"Asset Inventory","tag":"Asset Inventory","page":"telemetry/DC0110/","kind":"attack_component"},{"id":"DC0108","name":"Device Alarm","tag":"Device Alarm","page":"telemetry/DC0108/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M0802","name":"Communication Authenticity","url":"https://attack.mitre.org/mitigations/M0802","kind":"course-of-action","description":"Protocols used for control functions should provide authenticity through MAC functions or digital signatures. If not, utilize bump-in-the-wire devices or VPNs to enforce communication authenticity between devices that are not capable of supporting this (e.g., legacy controllers, RTUs).\n","relationship_id":"relationship--7db9687b-7099-4cb6-a040-bc32fc549a81","references":[]},{"id":"M0807","name":"Network Allowlists","url":"https://attack.mitre.org/mitigations/M0807","kind":"course-of-action","description":"Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. (Citation: Department of Homeland Security September 2016)\n","relationship_id":"relationship--652a68a2-a26b-4e8c-86dd-fd83187ed043","references":[{"source_name":"Department of Homeland Security September 2016","description":"Department of Homeland Security 2016, September Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"}]},{"id":"M0813","name":"Software Process and Device Authentication","url":"https://attack.mitre.org/mitigations/M0813","kind":"course-of-action","description":"Devices should authenticate all messages between master and outstation assets.\n","relationship_id":"relationship--0f8a6c14-1050-404a-bb6e-4fe107d5b6cd","references":[]},{"id":"M0930","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M0930","kind":"course-of-action","description":"Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment. (Citation: Karen Scarfone; Paul Hoffman September 2009) (Citation: Keith Stouffer May 2015) (Citation: Department of Homeland Security September 2016) (Citation: Dwight Anderson 2014) \n","relationship_id":"relationship--61668e93-6d9d-418d-9fbd-2d88c3a66544","references":[{"source_name":"Karen Scarfone; Paul Hoffman September 2009","description":"Karen Scarfone; Paul Hoffman 2009, September Guidelines on Firewalls and Firewall Policy Retrieved. 2020/09/25 ","url":"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf"},{"source_name":"Keith Stouffer May 2015","description":"Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"},{"source_name":"Department of Homeland Security September 2016","description":"Department of Homeland Security 2016, September Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"},{"source_name":"Dwight Anderson 2014","description":"Dwight Anderson 2014 Protect Critical Infrastructure Systems With Whitelisting Retrieved. 2020/09/25 ","url":"https://www.sans.org/reading-room/whitepapers/ICS/protect-critical-infrastructure-systems-whitelisting-35312"}]},{"id":"M0937","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M0937","kind":"course-of-action","description":"Perform inline allowlisting of automation protocol commands  to prevent devices from sending unauthorized command or reporting messages. Allow/denylist techniques need to be designed with sufficient accuracy to prevent the unintended blocking of valid reporting messages.\n","relationship_id":"relationship--575f0e0b-d68d-432b-abb3-cbd3e641fc88","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0848":"/ttp-simulation/techniques/ics/T0848/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0848","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0110","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","role":"PLC_fixture","firmware":"lab-1.0","source":"approved_inventory"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0108","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","alarm_code":"LAB_COMM_LOSS","severity":"warning","active":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}