{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0869","id":"T0869","name":"Standard Application Layer Protocol","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0869","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"f1a8a0d61dd9402281ced98fd35a0639946e763d8d77c4912555894a8b6f3deb","description":"Adversaries may establish command and control capabilities over commonly used application layer protocols such as HTTP(S), OPC, RDP, telnet, DNP3, and modbus. These protocols may be used to disguise adversary actions as benign network traffic. Standard protocols may be seen on their associated port or in some cases over a non-standard port.  Adversaries may use these protocols to reach out of the network for command and control, or in some cases to other infected devices within the network.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0869","external_id":"T0869"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"ics/T0869.001","id":"T0869.001","name":"DNS","page":"techniques/ics/T0869.001/"},{"key":"ics/T0869.002","id":"T0869.002","name":"Publish/Subscribe Protocols","page":"techniques/ics/T0869.002/"}],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"ics/T0869","id":"T0869","name":"Standard Application Layer Protocol","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0869","technique_page":"techniques/ics/T0869/","page":"detections/ics/T0869/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0799","name":"Detection of Standard Application Layer Protocol","url":"https://attack.mitre.org/detectionstrategies/DET0799","stix_id":"x-mitre-detection-strategy--732d2487-3241-4866-8bb5-044bb4acdd3b","relationship_id":"relationship--18af4cd0-5941-4754-86b8-5d2389fd5524","description":"","analytics":[{"id":"AN1931","name":"Analytic 1931","guidance":"Real-time monitoring identifies Domain Name System (DNS) queries from Industrial Control System (ICS) host Internet Protocol (IP) addresses to external resolvers for domains not associated with any approved ICS vendor, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.","url":"https://attack.mitre.org/detectionstrategies/DET0799#AN1931","platforms":["Network Devices"],"tuning":[{"field":"ApprovedVendorDomains","description":"Allowlist of legitimate vendor/business domains for application-layer protocol traffic."},{"field":"NoExternalConnectivityRoleList","description":"Inventory of ICS hosts whose role does not require external application-layer connectivity."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"dns:querylog","channel":"Domain Name System (DNS) query from Industrial Control Systems (ICS) host to domain not in approved vendor domains, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns","platforms":["Network Devices"],"analytic_id":"AN1931","source_url":"https://attack.mitre.org/detectionstrategies/DET0799#AN1931","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN2155","name":"Analytic 2155","guidance":"Real-time monitoring identifies Industrial Control System (ICS) Linux service processes initiating outbound application-layer protocol connections to ports/destinations outside the approved communication matrix. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.","url":"https://attack.mitre.org/detectionstrategies/DET0799#AN2155","platforms":["Linux"],"tuning":[{"field":"ApprovedVendorDomains","description":"Allowlist of legitimate vendor/business domains for application-layer protocol traffic."},{"field":"NoExternalConnectivityRoleList","description":"Inventory of ICS hosts whose role does not require external application-layer connectivity."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscall from an ICS service/application process to a destination outside the approved network or vendor-service baseline","platforms":["Linux"],"analytic_id":"AN2155","source_url":"https://attack.mitre.org/detectionstrategies/DET0799#AN2155","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN2223","name":"Analytic 2223","guidance":"Near-real-time connection monitoring identifies an embedded field device or gateway initiating outbound connections on standard application-layer protocol ports to destinations outside the expected Industrial Control System (ICS) communication baseline. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. This analytic is implementable from session/flow metadata (endpoints, ports, protocol/service, timing, bytes); it does not require or claim packet-payload visibility.","url":"https://attack.mitre.org/detectionstrategies/DET0799#AN2223","platforms":["Embedded"],"tuning":[{"field":"ApprovedVendorDomains","description":"Allowlist of legitimate vendor/business domains for application-layer protocol traffic."},{"field":"NoExternalConnectivityRoleList","description":"Inventory of ICS hosts whose role does not require external application-layer connectivity."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Connections","channel":"Connection/session metadata: embedded device opens HTTP/HTTPS/DNS session to destination outside approved ICS communication baseline","platforms":["Embedded"],"analytic_id":"AN2223","source_url":"https://attack.mitre.org/detectionstrategies/DET0799#AN2223","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2281","name":"Analytic 2281","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) Windows host making outbound connections on HTTP/HTTPS/DNS ports to destinations outside the approved Industrial Control System (ICS) communication baseline, from processes that are not recognized Industrial Control System (ICS) vendor applications. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.","url":"https://attack.mitre.org/detectionstrategies/DET0799#AN2281","platforms":["Windows"],"tuning":[{"field":"ApprovedVendorDomains","description":"Allowlist of legitimate vendor/business domains for application-layer protocol traffic."},{"field":"NoExternalConnectivityRoleList","description":"Inventory of ICS hosts whose role does not require external application-layer connectivity."}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3 on Hypertext Transfer Protocol (HTTP)/Hypertext Transfer Protocol Secure (HTTPS)/Domain Name System (DNS) port from process not recognized as Industrial Control Systems (ICS) vendor application","platforms":["Windows"],"analytic_id":"AN2281","source_url":"https://attack.mitre.org/detectionstrategies/DET0799#AN2281","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0089","name":"BlackEnergy","url":"https://attack.mitre.org/software/S0089","kind":"malware","description":"[BlackEnergy](https://attack.mitre.org/software/S0089) uses HTTP POST request to contact external command and control servers. (Citation: Booz Allen Hamilton)\n","relationship_id":"relationship--3a7d1db3-9383-4171-8938-382e9b0375c6","references":[{"source_name":"Booz Allen Hamilton","description":"Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.","url":"https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) sends HTTPS POST messages with randomly generated URLs to communicate with a remote server. (Citation: Tom Fakterman August 2019) (Citation: SecureWorks September 2019)","relationship_id":"relationship--c90cfddb-253b-41c8-9057-2abde6f8aa6d","references":[{"source_name":"SecureWorks September 2019","description":"SecureWorks 2019, September 24 REvil/Sodinokibi Ransomware Retrieved. 2021/04/12 ","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"},{"source_name":"Tom Fakterman August 2019","description":"Tom Fakterman 2019, August 05 Sodinokibi: The Crown Prince of Ransomware Retrieved. 2021/04/12 ","url":"https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) uses a thread to monitor a data block DB890 of sequence A or B. This thread is constantly running and probing this block (every 5 minutes). On an infected PLC, if block DB890 is found and contains a special magic value (used by Stuxnet to identify his own block DB890), this blocks data can be read and written. This thread is likely used to optimize the way sequences A and B work, and modify their behavior when the Step7 editor is opened. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--bc383819-2e40-49b4-bea9-95eb5d418877","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S1009","name":"Triton","url":"https://attack.mitre.org/software/S1009","kind":"malware","description":"[Triton](https://attack.mitre.org/software/S1009) can communicate with the implant utilizing the TriStation 'get main processor diagnostic data' command and looks for a specifically crafted packet body from which it extracts a command value and its arguments. (Citation: Jos Wetzels January 2018)","relationship_id":"relationship--f584a257-c22a-434b-aa2d-6220987821ab","references":[{"source_name":"Jos Wetzels January 2018","description":"Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ","url":"https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"}]},{"id":"S1045","name":"INCONTROLLER","url":"https://attack.mitre.org/software/S1045","kind":"malware","description":"[INCONTROLLER](https://attack.mitre.org/software/S1045) can remotely send commands to a malicious agent uploaded on Omron PLCs over HTTP or HTTPS.(Citation: CISA-AA22-103A) ","relationship_id":"relationship--0d4f2f88-e176-42c7-8258-52b345045662","references":[{"source_name":"CISA-AA22-103A","description":"DHS/CISA. (2022, May 25). Alert (AA22-103A) APT Cyber Tools Targeting ICS/SCADA Devices. Retrieved September 28, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"}]},{"id":"S1165","name":"FrostyGoop","url":"https://attack.mitre.org/software/S1165","kind":"malware","description":"[FrostyGoop](https://attack.mitre.org/software/S1165) utilizes the Modbus protocol for transmitting commands to victim devices.(Citation: Dragos FROSTYGOOP 2024)","relationship_id":"relationship--5c8c8976-2cac-4185-9719-ef55c1032d6a","references":[{"source_name":"Dragos FROSTYGOOP 2024","description":"Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.","url":"https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"}]}],"actors":[{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) communicated with its command and control using HTTP requests. (Citation: Robert Falcone, Bryan Lee May 2016)","relationship_id":"relationship--d2dc57eb-5be2-4f9c-a4f7-18d2085ff412","references":[{"source_name":"Robert Falcone, Bryan Lee May 2016","description":"Robert Falcone, Bryan Lee 2016, May 26 The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor Retrieved. 2019/11/19 ","url":"https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"}]}],"mitigations":[{"id":"M0807","name":"Network Allowlists","url":"https://attack.mitre.org/mitigations/M0807","kind":"course-of-action","description":"Network allowlists can be implemented through either host-based files or system host files to specify what external connections (e.g., IP address, MAC address, port, protocol) can be made from a device. Allowlist techniques that operate at the application layer (e.g., DNP3, Modbus, HTTP) are addressed in the [Filter Network Traffic](https://attack.mitre.org/mitigations/M0937) mitigation.","relationship_id":"relationship--d854cc38-adf7-485d-96b5-70606f6cb87e","references":[]},{"id":"M0930","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M0930","kind":"course-of-action","description":"Ensure proper network segmentation between higher level corporate resources and the control process environment.\n","relationship_id":"relationship--0ff88ef7-44fd-4307-b381-2e0bc76ce83b","references":[]},{"id":"M0931","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M0931","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.\n","relationship_id":"relationship--5be1f2b1-75fd-4e7e-901b-495cee4ab5ad","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0869":"/ttp-simulation/techniques/ics/T0869/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0869","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}