{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0869.001","id":"T0869.001","name":"DNS","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0869/001","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"51d9be1f44a5f2d9d5aed33eaceae64184ebe356f397c498b45805c38e442d96","description":"Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.\nThe DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling)\n\nDNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. Protocol Tunneling). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government)\n DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.\n\nAdversaries may also use DNS over TLS (DoT) or HTTPS (DoH) for resolving C2 servers. This encrypts the DNS requests and allows the malware to lookup C2 servers without being detected by security systems (e.g., DNS filtering based on indicators of compromise). \n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0869/001","external_id":"T0869.001"},{"source_name":"Medium DnsTunneling","description":"Galobardes, R. (2018, October 30). Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it). Retrieved March 15, 2020.","url":"https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000"},{"source_name":"OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government","description":"Kyle Wilhoit, Robert Falcone. (2018, September 12). OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/"},{"source_name":"PAN DNS Tunneling","description":"Palo Alto Networks. (n.d.). What Is DNS Tunneling?. Retrieved March 15, 2020.","url":"https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling"},{"source_name":"DNS Beacons","description":"Vercara. (n.d.). Retrieved July 21, 2025.","url":"https://vercara.digicert.com/resources/dns-beacons#page_top"}],"platforms":[],"environments":["ics-ot"],"visibility":"source_mapped","visibility_note":null,"parent":{"key":"ics/T0869","id":"T0869","name":"Standard Application Layer Protocol","domain":"ics","level":"technique","parent_id":null,"tactics":["command-and-control"],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"page":"techniques/ics/T0869/","constraints":["isolated_authorized_lab","procedure_review_required","telemetry_configuration_required","ot_fixture_and_process_safety_review"],"telemetry_tags":["Network Connection Creation","Network Traffic Content","Network Traffic Flow"],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"detections":{"page":"detections/ics/T0869/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"anomaly_types":[]},"detection_status":"guidance_only","anomaly_tags":[],"tool_tags":[],"tool_references":[],"visibility":"source_mapped","telemetry_status":"mapped","classification":"cannot_simulate_yet","candidate_count":0,"implementation":"not_integrated","methods":[]},"children":[],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"ics/T0869.001","id":"T0869.001","name":"DNS","domain":"ics","platforms":[],"environments":["ics-ot"],"source_url":"https://attack.mitre.org/techniques/T0869/001","technique_page":"techniques/ics/T0869.001/","page":"detections/ics/T0869.001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0934","name":"Behavioral Detection of DNS Protocol Misuse for Command and Control","url":"https://attack.mitre.org/detectionstrategies/DET0934","stix_id":"x-mitre-detection-strategy--43a670e7-e016-4c29-8ec2-85c18e30f030","relationship_id":"relationship--59a2d15c-f4a4-4df8-ab33-2966db4e2500","description":"","analytics":[{"id":"AN2099","name":"Analytic 2099","guidance":"Real-time monitoring identifies an ICS Windows asset bypassing designated DNS resolvers, generating tunneling-like DNS content, or establishing HTTPS/TLS sessions to unapproved DoH resolver/API infrastructure from a process not authorized for encrypted DNS. Require a resolver-policy or asset-role violation plus suspicious query/content/process/destination evidence; suppress approved browsers, security products, vendor cloud services, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2099","platforms":["Windows"],"tuning":[{"field":"ApprovedResolvers","description":"Site DNS resolvers and forwarding architecture"},{"field":"ApprovedDoHProviders","description":"Explicitly permitted DoH/DoT endpoints, if any"},{"field":"AuthorizedDoHProcesses","description":"Browsers/security/vendor software permitted to use encrypted DNS"},{"field":"QueryPattern","description":"Length/entropy/type/frequency patterns used only as corroboration"},{"field":"NoExternalConnectivityRoleList","description":"ICS assets that should not resolve/connect externally"}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3; connection to DNS/DoH destination with process identity","platforms":["Windows"],"analytic_id":"AN2099","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2099","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:DNS","channel":"Native DNS query/response content: long/encoded labels, TXT use, unusual query structure","platforms":["Windows"],"analytic_id":"AN2099","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2099","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Direct external DNS or HTTPS/TLS flow bypassing designated resolver/proxy","platforms":["Windows"],"analytic_id":"AN2099","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2099","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2097","name":"Analytic 2097","guidance":"Real-time monitoring identifies ICS clients sending DNS directly to unauthorized resolvers, native DNS with tunneling characteristics, or HTTPS/TLS connections to known/identified DoH infrastructure that bypass the site resolver/proxy architecture. Alert on policy violation plus content/flow corroboration; do not alert solely on high DNS volume.","url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2097","platforms":["Network Devices"],"tuning":[{"field":"ApprovedResolvers","description":"Authorized recursive resolvers/forwarders"},{"field":"ApprovedDoHProviders","description":"Permitted encrypted DNS services"},{"field":"ApprovedCommunicationMatrix","description":"Which ICS zones/assets may resolve externally"},{"field":"QueryPattern","description":"Encoded/long labels, unusual types, entropy and periodicity as corroboration"},{"field":"KnownDoHEndpoints","description":"Resolver/API destinations used to identify bypass"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NetworkDevice:IDS","channel":"DoH/DoT identification, SNI/HTTP host when observable, DNS tunneling signatures","platforms":["Network Devices"],"analytic_id":"AN2097","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2097","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:DNS","channel":"DNS query/response metadata and content","platforms":["Network Devices"],"analytic_id":"AN2097","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2097","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Client-to-resolver or client-to-DoH endpoint flow","platforms":["Network Devices"],"analytic_id":"AN2097","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2097","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2098","name":"Analytic 2098","guidance":"Real-time monitoring identifies a Linux ICS asset bypassing designated DNS resolvers, producing tunneling-like native DNS, or connecting to unapproved DoH/DoT infrastructure from an unauthorized process/service. Require resolver-policy or asset-role violation plus corroborating process, query, or destination evidence; suppress approved package/vendor/security workflows.","url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2098","platforms":["Linux"],"tuning":[{"field":"ApprovedResolvers","description":"Site DNS resolvers"},{"field":"ApprovedDoHProviders","description":"Permitted encrypted DNS endpoints"},{"field":"AuthorizedProcesses","description":"Services permitted to resolve externally"},{"field":"QueryPattern","description":"Tunneling-like query characteristics as corroboration"},{"field":"NoExternalConnectivityRoleList","description":"Assets with no legitimate external resolution"}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"linux:osquery","channel":"socket_events to DNS/DoH/DoT destinations, where deployed","platforms":["Linux"],"analytic_id":"AN2098","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2098","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:DNS","channel":"Native DNS query/response content","platforms":["Linux"],"analytic_id":"AN2098","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2098","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"External DNS/HTTPS/TLS flow bypassing approved resolver/proxy","platforms":["Linux"],"analytic_id":"AN2098","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2098","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2096","name":"Analytic 2096","guidance":"Real-time monitoring identifies an embedded OT/IoT device sending DNS to a resolver not defined for its role, tunneling-like native DNS, or direct HTTPS/TLS to an unapproved DoH endpoint. Because many embedded devices have fixed communications, require deviation from the device-specific resolver/destination profile and corroborating query or destination evidence.","url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2096","platforms":["Embedded"],"tuning":[{"field":"DeviceResolverProfile","description":"Expected DNS resolver(s) per device/model/site"},{"field":"ApprovedVendorDomains","description":"Vendor/cloud domains required for operation"},{"field":"ApprovedDoHProviders","description":"Permitted encrypted DNS, normally empty for fixed-function devices"},{"field":"NoExternalConnectivityRoleList","description":"Devices that should not resolve externally"},{"field":"QueryPattern","description":"Tunneling characteristics used as corroboration, not sole trigger"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:TLS/HTTP","channel":"SNI/HTTP host or resolver endpoint identification when observable","platforms":["Embedded"],"analytic_id":"AN2096","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2096","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:DNS","channel":"Device DNS query/response content","platforms":["Embedded"],"analytic_id":"AN2096","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2096","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Device-to-resolver/DoH destination flow","platforms":["Embedded"],"analytic_id":"AN2096","source_url":"https://attack.mitre.org/detectionstrategies/DET0934#AN2096","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S9046","name":"IOControl","url":"https://attack.mitre.org/software/S9046","kind":"malware","description":"IOCONTROL has used DNS over HTTPS (DoH) via CloudFlare’s API to translate hostnames to IP addresses.(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL)\n\n\n","relationship_id":"relationship--d16098fd-9b2d-479c-a25a-f970bce86f94","references":[{"source_name":"Claroty-IOCONTROL","description":"Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.","url":"https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"},{"source_name":"Dragos 2025 Year in Review","description":"Dragos. (2026, February). 9TH ANNUAL YEAR IN REVIEW | OT/ICS CYBERSECURITY REPORT . Retrieved April 26, 2026.","url":"https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf?hsCtaAttrib=205683189348"},{"source_name":"Armis-IOCONTROL","description":"Michael Freeman. (2024, December 16). IOControl Malware: What's New, What's Not?. Retrieved September 2, 2026.","url":"https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/"}]}],"actors":[],"mitigations":[{"id":"M0931","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M0931","kind":"course-of-action","description":"Use network security controls to identify and, where operationally safe, block DNS tunneling, unauthorized resolver use, suspicious DoH/DoT destinations, and known malicious DNS infrastructure at controlled ICS egress points.","relationship_id":"relationship--01914eb7-9c43-4170-9f0e-f7c2a2c4d396","references":[]},{"id":"M0937","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M0937","kind":"course-of-action","description":"Require ICS assets to use approved DNS resolvers and restrict direct DNS, DoT, and DoH to unauthorized external resolvers or services. Apply allowlists for documented vendor/cloud dependencies and monitor exceptions rather than assuming all encrypted DNS is malicious.","relationship_id":"relationship--2bfb3a93-422c-4a36-a9c2-c5a9e79477d8","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0869.001":"/ttp-simulation/techniques/ics/T0869.001/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0869.001","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}