{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0860","id":"T0860","name":"Wireless Compromise","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0860","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"f9a28faeabe780d28bb71731bdc8413f2914cfe569f0d26ad443fb72f06a684d","description":"Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network. Access to a wireless network may be gained through the compromise of a wireless device. (Citation: Alexander Bolshev, Gleb Cherbov July 2014) (Citation: Alexander Bolshev March 2014) Adversaries may also utilize radios and other wireless communication devices on the same frequency as the wireless network. Wireless compromise can be done as an initial access vector from a remote distance. \n\nA Polish student used a modified TV remote controller to gain access to and control over the Lodz city tram system in Poland. (Citation: John Bill May 2017) (Citation: Shelley Smith February 2008) The remote controller device allowed the student to interface with the trams network to modify track settings and override operator control. The adversary may have accomplished this by aligning the controller to the frequency and amplitude of IR control protocol signals. (Citation: Bruce Schneier January 2008) The controller then enabled initial access to the network, allowing the capture and replay of tram signals. (Citation: John Bill May 2017)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0860","external_id":"T0860"},{"source_name":"Alexander Bolshev March 2014","description":"Alexander Bolshev 2014, March 11 S4x14: HART As An Attack Vector Retrieved November 17, 2024. ","url":"https://www.slideshare.net/slideshow/17-bolshev-1-13/32178888"},{"source_name":"Alexander Bolshev, Gleb Cherbov July 2014","description":"Alexander Bolshev, Gleb Cherbov 2014, July 08 ICSCorsair: How I will PWN your ERP through 4-20 mA current loop Retrieved. 2020/01/05 ","url":"https://www.blackhat.com/docs/us-14/materials/us-14-Bolshev-ICSCorsair-How-I-Will-PWN-Your-ERP-Through-4-20mA-Current-Loop-WP.pdf"},{"source_name":"Bruce Schneier January 2008","description":"Bruce Schneier 2008, January 17 Hacking Polish Trams Retrieved. 2019/10/17 ","url":"https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html"},{"source_name":"John Bill May 2017","description":"John Bill 2017, May 12 Hacked Cyber Security Railways Retrieved. 2019/10/17 ","url":"https://www.londonreconnections.com/2017/hacked-cyber-security-railways/"},{"source_name":"Shelley Smith February 2008","description":"Shelley Smith 2008, February 12 Teen Hacker in Poland Plays Trains and Derails City Tram System Retrieved. 2019/10/17 ","url":"https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/"}],"platforms":["Embedded","Windows","Linux"],"environments":["cloud-hosted-endpoint","ics-ot","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0034","name":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component","category":"Host state and inventory","description":"Point-in-time process properties such as owner, executable and start time.","collection_focus":"Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["process_id","image","owner_uid","started_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"ics/T0860","id":"T0860","name":"Wireless Compromise","domain":"ics","platforms":["Embedded","Windows","Linux"],"environments":["cloud-hosted-endpoint","ics-ot","onprem"],"source_url":"https://attack.mitre.org/techniques/T0860","technique_page":"techniques/ics/T0860/","page":"detections/ics/T0860/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0726","name":"Detection of Wireless Compromise","url":"https://attack.mitre.org/detectionstrategies/DET0726","stix_id":"x-mitre-detection-strategy--7f32731d-7800-483c-b077-c4a187a27ae5","relationship_id":"relationship--16cca881-cf8b-4651-9ab1-cc8507cadd58","description":"","analytics":[{"id":"AN1859","name":"Analytic 1859","guidance":"Real-time monitoring identifies a previously unseen wireless device identity joining or authenticating to an ICS wireless segment—such as Wi-Fi/802.1X, WirelessHART, ISA100.11a, or a vendor radio mesh—when its MAC/EUI, certificate, or device identifier is absent from the approved wireless asset inventory. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0726#AN1859","platforms":["Embedded"],"tuning":[{"field":"ApprovedWirelessDeviceInventory","description":"MAC/certificate inventory of devices authorized to associate with ICS wireless infrastructure."},{"field":"DesignatedWirelessManagementStations","description":"Hosts authorized to legitimately enable wireless monitor mode for diagnostics."},{"field":"WirelessOnboardWindow","description":"Time window after wireless association within which ICS-directed traffic is considered part of the same onboarding event."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"netflow:ipfix","channel":"IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): traffic from newly-authenticated device to Industrial Control System (ICS) application server within onboard window of association","platforms":["Embedded"],"analytic_id":"AN1859","source_url":"https://attack.mitre.org/detectionstrategies/DET0726#AN1859","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"wireless:radius","channel":"Extensible Authentication Protocol (EAP) authentication success for device Media Access Control (MAC)/certificate not in approved wireless device inventory","platforms":["Embedded"],"analytic_id":"AN1859","source_url":"https://attack.mitre.org/detectionstrategies/DET0726#AN1859","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]},{"id":"AN2124","name":"Analytic 2124","guidance":"Real-time monitoring identifies a process executing iwconfig or ip link set  promisc, or loading mac80211 monitor mode, on an Industrial Control System (ICS) Linux asset outside normal configuration management activity. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0726#AN2124","platforms":["Linux"],"tuning":[{"field":"ApprovedWirelessDeviceInventory","description":"MAC/certificate inventory of devices authorized to associate with ICS wireless infrastructure."},{"field":"DesignatedWirelessManagementStations","description":"Hosts authorized to legitimately enable wireless monitor mode for diagnostics."},{"field":"WirelessOnboardWindow","description":"Time window after wireless association within which ICS-directed traffic is considered part of the same onboarding event."}],"log_sources":[{"component_id":"DC0034","component":"Process Metadata","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor/promiscuous mode outside change management window","platforms":["Linux"],"analytic_id":"AN2124","source_url":"https://attack.mitre.org/detectionstrategies/DET0726#AN2124","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"}]},{"id":"AN2269","name":"Analytic 2269","guidance":"Real-time monitoring identifies a Windows process enabling promiscuous or monitor mode on a wireless adapter (netsh wlan, WinPcap/Npcap driver load, etc.) on an Industrial Control System (ICS) workstation that is not a designated wireless management station, indicating preparation for wireless interception consistent with this technique's reconnaissance phase. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0726#AN2269","platforms":["Windows"],"tuning":[{"field":"ApprovedWirelessDeviceInventory","description":"MAC/certificate inventory of devices authorized to associate with ICS wireless infrastructure."},{"field":"DesignatedWirelessManagementStations","description":"Hosts authorized to legitimately enable wireless monitor mode for diagnostics."},{"field":"WirelessOnboardWindow","description":"Time window after wireless association within which ICS-directed traffic is considered part of the same onboarding event."}],"log_sources":[]}]}],"telemetry_references":[{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0034","name":"Process Metadata","tag":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M0802","name":"Communication Authenticity","url":"https://attack.mitre.org/mitigations/M0802","kind":"course-of-action","description":"Do not inherently rely on the authenticity provided by the network/link layer (e.g., 802.11, LTE, 802.15.4), as link layer equipment may have long lifespans and protocol vulnerabilities may not be easily patched. Provide defense-in-depth by implementing authenticity within the associated application-layer protocol, or through a network-layer VPN. (Citation: CISA March 2010)  Furthermore, ensure communication schemes provide strong replay protection, employing techniques such as timestamps or cryptographic nonces.\n","relationship_id":"relationship--3ab912a4-70aa-45f8-b2ef-57113dde2cfa","references":[{"source_name":"CISA March 2010","description":"CISA 2010, March 11 https://us-cert.cisa.gov/ncas/tips/ST05-003 Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/ncas/tips/ST05-003"}]},{"id":"M0806","name":"Minimize Wireless Signal Propagation","url":"https://attack.mitre.org/mitigations/M0806","kind":"course-of-action","description":"Techniques can include (i) reducing transmission power on wireless signals, (ii) adjusting antenna gain to prevent extensions beyond organizational boundaries, and (iii) employing RF shielding techniques to block excessive signal propagation. (Citation: DHS  National Urban Security Technology Laboratory April 2019)\n","relationship_id":"relationship--b2e10e48-8bd9-472a-9c6f-1d38650e8df1","references":[{"source_name":"DHS  National Urban Security Technology Laboratory April 2019","description":"DHS  National Urban Security Technology Laboratory 2019, April Radio Frequency Detection, Spectrum Analysis, and Direction Finding Equipment Retrieved. 2020/09/17 ","url":"https://www.dhs.gov/sites/default/files/saver-msr-rf-detection_cod-508_10july2019.pdf"}]},{"id":"M0808","name":"Encrypt Network Traffic","url":"https://attack.mitre.org/mitigations/M0808","kind":"course-of-action","description":"Utilize strong cryptographic techniques and protocols to prevent eavesdropping on network communications.\n","relationship_id":"relationship--b363cbbb-679c-47e0-8ad0-af98ebf51e60","references":[]},{"id":"M0813","name":"Software Process and Device Authentication","url":"https://attack.mitre.org/mitigations/M0813","kind":"course-of-action","description":"Ensure wireless networks require the authentication of all devices, and that all wireless devices also authenticate network infrastructure devices (i.e., mutual authentication). For defense-in-depth purposes, utilize VPNs or ensure that application-layer protocols also authenticate the system or device. Use protocols that provide strong authentication (e.g., IEEE 802.1X), and enforce basic protections, such as MAC filtering, when stronger cryptographic techniques are not available.\n","relationship_id":"relationship--3f335e8f-68da-4b06-9d96-f371ddaf23e6","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0860":"/ttp-simulation/techniques/ics/T0860/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0860","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}}]}}