{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T1691","id":"T1691","name":"Block Operational Technology Message","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1691","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"3891375dfc2a173d8a077c7002795271743db3e707945a64d2118043988b0942","description":"Adversaries may block messages between systems and devices in an OT/ICS environment to disrupt processes. Messages typically fall into two categories: (1) reporting messages that contain telemetry data about the current state of systems, devices, and processes and (2) command messages that contain instructions to control systems, devices, and processes. Both types of messages are critical for the proper functioning of industrial control processes and failure of the messages to reach their intended destinations could inhibit response functions or create an unsafe condition that could have physical impacts.(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)(Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)\n\nAdversaries may block communications by either making modifications to software ([System Firmware](https://attack.mitre.org/techniques/T0857), [Module Firmware](https://attack.mitre.org/techniques/T0839), [Hooking](https://attack.mitre.org/techniques/T0874), and [Rootkit](https://attack.mitre.org/techniques/T0851)) and services ([Service Stop](https://attack.mitre.org/techniques/T0881), [Denial of Service](https://attack.mitre.org/techniques/T0814)) on systems and devices or by positioning themselves between systems and devices and intercepting and blocking the communications such as the case with an [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T0830) attack.\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1691","external_id":"T1691"},{"source_name":"Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011","description":"Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ","url":"http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"},{"source_name":"Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016","description":"Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems 2016, March 18 Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case Retrieved. 2018/03/27 ","url":"https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt6a77276749b76a40/607f235992f0063e5c070fff/E-ISAC_SANS_Ukraine_DUC_5%5b73%5d.pdf"}],"platforms":["Embedded","Windows","Linux"],"environments":["cloud-hosted-endpoint","ics-ot","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"ics/T1691.001","id":"T1691.001","name":"Command Message","page":"techniques/ics/T1691.001/"},{"key":"ics/T1691.002","id":"T1691.002","name":"Reporting Message","page":"techniques/ics/T1691.002/"}],"telemetry":[{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0109","name":"Process/Event Alarm","page":"telemetry/DC0109/","kind":"attack_component","category":"Industrial operations and physical process","description":"Alarms raised by process conditions or operational events.","collection_focus":"Export alarm/event history with setpoint context and lifecycle transitions; retain suppressed/shelved state when provided.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["tag","alarm","threshold","value","acknowledged"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0109","collector":"illustrative-lab-collector","observation":{"tag":"LAB.TankLevel","alarm":"high_level","threshold":80,"value":82,"acknowledged":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"attack_component","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."}],"detection":{"key":"ics/T1691","id":"T1691","name":"Block Operational Technology Message","domain":"ics","platforms":["Embedded","Windows","Linux"],"environments":["cloud-hosted-endpoint","ics-ot","onprem"],"source_url":"https://attack.mitre.org/techniques/T1691","technique_page":"techniques/ics/T1691/","page":"detections/ics/T1691/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0903","name":"Detection of Block Operational Technology Message","url":"https://attack.mitre.org/detectionstrategies/DET0903","stix_id":"x-mitre-detection-strategy--6f318bab-df4a-4a51-b849-e9c2ab2f9c4c","relationship_id":"relationship--00e34880-abdb-418d-9252-0433aa40950e","description":"","analytics":[{"id":"AN2046","name":"Analytic 2046","guidance":"Real-time monitoring identifies iptables/nftables rule changes on Industrial Control System (ICS) Linux gateways that selectively block one ICS communication traffic type. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0903#AN2046","platforms":["Linux"],"tuning":[{"field":"CommunicationGapThreshold","description":"Time threshold beyond the expected communication interval that constitutes a gap warranting investigation."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline","platforms":["Linux"],"analytic_id":"AN2046","source_url":"https://attack.mitre.org/detectionstrategies/DET0903#AN2046","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN2213","name":"Analytic 2213","guidance":"Real-time monitoring identifies an abrupt cessation of expected Industrial Control System (ICS) protocol traffic between a Supervisory Control and Data Acquisition (SCADA)/control server and a field device, without a corresponding device alarm or scheduled maintenance event, while the device remains reachable for at least some traffic types. This technique-level analytic synthesizes Command Message blocking (T1691.001) and Reporting Message blocking (T1691.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0903#AN2213","platforms":["Embedded"],"tuning":[{"field":"CommunicationGapThreshold","description":"Time threshold beyond the expected communication interval that constitutes a gap warranting investigation."}],"log_sources":[{"component_id":"DC0109","component":"Process/Event Alarm","name":"operationaldb:AlarmEvent","channel":"expected communication absent for device_ip without corresponding device-generated alarm explaining the gap","platforms":["Embedded"],"analytic_id":"AN2213","source_url":"https://attack.mitre.org/detectionstrategies/DET0903#AN2213","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0109/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Connections","channel":"one Industrial Control System (ICS) traffic type (command or reporting) to/from device_ip ceases while other traffic types continue normally","platforms":["Embedded"],"analytic_id":"AN2213","source_url":"https://attack.mitre.org/detectionstrategies/DET0903#AN2213","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2266","name":"Analytic 2266","guidance":"Real-time monitoring identifies Windows host-based firewall or network policy changes that selectively block Industrial Control System (ICS) communication traffic types from Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) hosts. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0903#AN2266","platforms":["Windows"],"tuning":[{"field":"CommunicationGapThreshold","description":"Time threshold beyond the expected communication interval that constitutes a gap warranting investigation."}],"log_sources":[]}]}],"telemetry_references":[{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0109","name":"Process/Event Alarm","tag":"Process/Event Alarm","page":"telemetry/DC0109/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M0807","name":"Network Allowlists","url":"https://attack.mitre.org/mitigations/M0807","kind":"course-of-action","description":"Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support.","relationship_id":"relationship--f76dd26b-2aa3-4fc3-bdef-ddd0632d851b","references":[]},{"id":"M0810","name":"Out-of-Band Communications Channel","url":"https://attack.mitre.org/mitigations/M0810","kind":"course-of-action","description":"Provide an alternative method for sending critical commands message to outstations, this could include using radio/cell communication to send messages to a field technician that physically performs the control function.","relationship_id":"relationship--69f9597e-a47d-49bb-a182-376349f979ef","references":[]},{"id":"M0814","name":"Static Network Configuration","url":"https://attack.mitre.org/mitigations/M0814","kind":"course-of-action","description":"Unauthorized connections can be prevented by statically defining the hosts and ports used for automation protocol connections.","relationship_id":"relationship--d3a24d5e-ae6e-4427-a1db-ae87b7a2b6e4","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0874":"/ttp-simulation/techniques/ics/T0874/","T0851":"/ttp-simulation/techniques/ics/T0851/","T0881":"/ttp-simulation/techniques/ics/T0881/","T0814":"/ttp-simulation/techniques/ics/T0814/","T0830":"/ttp-simulation/techniques/ics/T0830/","T1691":"/ttp-simulation/techniques/ics/T1691/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T1691","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0109","collector":"illustrative-lab-collector","observation":{"tag":"LAB.TankLevel","alarm":"high_level","threshold":80,"value":82,"acknowledged":false}}]}}