{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0871","id":"T0871","name":"Execution through API","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0871","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"e5f273e3c44052f4028301816d1cb9738010b473265f81bc1c7eab87d5ada35c","description":"Adversaries may attempt to leverage Application Program Interfaces (APIs) used for communication between control software and the hardware. Specific functionality is often coded into APIs which can be called by software to engage specific functions on a device or other software.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0871","external_id":"T0871"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."}],"detection":{"key":"ics/T0871","id":"T0871","name":"Execution through API","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0871","technique_page":"techniques/ics/T0871/","page":"detections/ics/T0871/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0742","name":"Detection of Execution through API","url":"https://attack.mitre.org/detectionstrategies/DET0742","stix_id":"x-mitre-detection-strategy--f1a7e304-d05f-4e48-89b7-8b034f507c32","relationship_id":"relationship--a20bde51-3ed9-4306-92cd-f4f12d3aa8aa","description":"","analytics":[{"id":"AN1875","name":"Analytic 1875","guidance":"Real-time monitoring identifies an unrecognized process on an ICS Linux host loading an ICS/vendor shared library that is normally restricted to approved control or engineering applications. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0742#AN1875","platforms":["Linux"],"tuning":[{"field":"ApprovedApplicationList","description":"Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests."},{"field":"ApprovedOPCClients","description":"Allowlist of OPC client application identities authorized to invoke write/control methods."},{"field":"AuthorizedICSApplications","description":"Allowlist of process executables permitted to load ICS vendor automation API libraries."}],"log_sources":[{"component_id":"DC0021","component":"OS API Execution","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): dlopen() of Industrial Control Systems (ICS) vendor shared library by process not in authorized ICS applications, followed by write-capable network connection to device subnet","platforms":["Linux"],"analytic_id":"AN1875","source_url":"https://attack.mitre.org/detectionstrategies/DET0742#AN1875","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]},{"id":"AN2208","name":"Analytic 2208","guidance":"Monitor OPC UA server audit events for state-changing Write or Method service invocations and compare ClientUserId, ClientApplicationUri, SourceNode/MethodId, status, and arguments with the approved client/method baseline. For servers that support auditing, AuditWriteUpdateEventType and AuditUpdateMethodEventType provide an analyst-visible record of writes and state-changing method calls. Alert on successful or attempted control operations from unapproved clients/users or against methods/nodes outside the documented engineering workflow; do not describe this as Windows OS API telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0742#AN2208","platforms":["Windows"],"tuning":[{"field":"ApprovedApplicationList","description":"Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests."},{"field":"ApprovedOPCClients","description":"Allowlist of OPC client application identities authorized to invoke write/control methods."},{"field":"AuthorizedICSApplications","description":"Allowlist of process executables permitted to load ICS vendor automation API libraries."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"opcua:AuditEvent","channel":"OPC UA AuditUpdateMethodEventType/AuditWriteUpdateEventType: ClientUserId, ClientApplicationUri, SourceNode/MethodId, Status and arguments for a state-changing method/write","platforms":["Windows"],"analytic_id":"AN2208","source_url":"https://attack.mitre.org/detectionstrategies/DET0742#AN2208","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7 where an ICS/vendor DLL is loaded by an image outside the authorized ICS application baseline","platforms":["Windows"],"analytic_id":"AN2208","source_url":"https://attack.mitre.org/detectionstrategies/DET0742#AN2208","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN2239","name":"Analytic 2239","guidance":"Real-time monitoring identifies Open Platform Communications (OPC) Unified Architecture (UA) method invocations or International Electrotechnical Commission (IEC) 61850 Abstract Common Services Interface (ACSI) service requests arriving at a field device from a client identity not in the approved application allowlist, where the invoked method is a write or control operation rather than read/subscribe. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0742#AN2239","platforms":["Embedded"],"tuning":[{"field":"ApprovedApplicationList","description":"Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests."},{"field":"ApprovedOPCClients","description":"Allowlist of OPC client application identities authorized to invoke write/control methods."},{"field":"AuthorizedICSApplications","description":"Allowlist of process executables permitted to load ICS vendor automation API libraries."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"write/control method invocation from client identity not in approved application list","platforms":["Embedded"],"analytic_id":"AN2239","source_url":"https://attack.mitre.org/detectionstrategies/DET0742#AN2239","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN2289","name":"Analytic 2289","guidance":"Real-time monitoring identifies network traffic to Industrial Control System (ICS) Application Programming Interface (API) ports such as 4840 used in the Open Platform Communications (OPC) Unified Architecture (UA) or vendor-specific API ports from source Internet Protocol (IP) addresses not in the approved application client list, where the traffic pattern is consistent with write/control method invocations rather than subscription/read traffic. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0742#AN2289","platforms":["Network Devices"],"tuning":[{"field":"ApprovedApplicationList","description":"Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests."},{"field":"ApprovedOPCClients","description":"Allowlist of OPC client application identities authorized to invoke write/control methods."},{"field":"AuthorizedICSApplications","description":"Allowlist of process executables permitted to load ICS vendor automation API libraries."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"zeek:ssl","channel":"Zeek ssl.log/TLS metadata: server_name (SNI), certificate chain/issuer/subject where available; compare with approved vendor domains/certificates","platforms":["Network Devices"],"analytic_id":"AN2289","source_url":"https://attack.mitre.org/detectionstrategies/DET0742#AN2289","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1009","name":"Triton","url":"https://attack.mitre.org/software/S1009","kind":"malware","description":"[Triton](https://attack.mitre.org/software/S1009) leverages a reconstructed TriStation protocol within its framework to trigger APIs related to program download, program allocation, and program changes. (Citation: Jos Wetzels January 2018)","relationship_id":"relationship--d72e7d01-56be-4fbd-8957-3384533ba83b","references":[{"source_name":"Jos Wetzels January 2018","description":"Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ","url":"https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"}]}],"actors":[{"id":"G1027","name":"CyberAv3ngers","url":"https://attack.mitre.org/groups/G1027","kind":"intrusion-set","description":"During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) leveraged existing PLC management protocols through the manufacturer’s engineering tools. These include EtherNet/IP CIP, S7Comm, and UMAS.(Citation: CISA-AA26-097A)","relationship_id":"relationship--21ccb883-2961-4b3a-9e1a-4439190aea49","references":[{"source_name":"CISA-AA26-097A","description":"Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"}]}],"mitigations":[{"id":"M0800","name":"Authorization Enforcement","url":"https://attack.mitre.org/mitigations/M0800","kind":"course-of-action","description":"All APIs used to perform execution, especially those hosted on embedded controllers (e.g., PLCs), should provide adequate authorization enforcement of user access. Minimize user's access to only required API calls. (Citation: MITRE June 2020)\n","relationship_id":"relationship--754521fc-4306-4daa-831b-6b6fb45847e2","references":[{"source_name":"MITRE June 2020","description":"MITRE 2020, June CWE CATEGORY: 7PK - API Abuse Retrieved. 2020/09/25 ","url":"https://cwe.mitre.org/data/definitions/227.html"}]},{"id":"M0801","name":"Access Management","url":"https://attack.mitre.org/mitigations/M0801","kind":"course-of-action","description":"Access Management technologies can be used to enforce authorization policies and decisions, especially when existing field devices do not provide capabilities to support user identification and authentication. (Citation: McCarthy, J et al. July 2018) These technologies typically utilize an in-line network device or gateway system to prevent access to unauthenticated users, while also integrating with an authentication service to first verify user credentials.\n","relationship_id":"relationship--efb80069-e4be-4055-bd34-06d1376b4601","references":[{"source_name":"McCarthy, J et al. July 2018","description":"McCarthy, J et al. 2018, July NIST SP 1800-2 Identity and Access Management for Electric Utilities Retrieved. 2020/09/17 ","url":"https://doi.org/10.6028/NIST.SP.1800-2"}]},{"id":"M0804","name":"Human User Authentication","url":"https://attack.mitre.org/mitigations/M0804","kind":"course-of-action","description":"All APIs on remote systems or local processes should require the authentication of users before executing any code or system changes.\n","relationship_id":"relationship--dded2d68-35c7-42c4-af10-efe7731673e3","references":[]},{"id":"M0938","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M0938","kind":"course-of-action","description":"Minimize the exposure of API calls that allow the execution of code.\n","relationship_id":"relationship--3d676c1b-2650-4599-8a57-790c55f9977d","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0871":"/ttp-simulation/techniques/ics/T0871/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0871","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}}]}}