1200KM / detection
T0860 Wireless Compromise — Detection Rules
Detection workspace for T0860 Wireless Compromise: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0726 Detection of Wireless Compromise
AN1859 Analytic 1859
Real-time monitoring identifies a previously unseen wireless device identity joining or authenticating to an ICS wireless segment—such as Wi-Fi/802.1X, WirelessHART, ISA100.11a, or a vendor radio mesh—when its MAC/EUI, certificate, or device identifier is absent from the approved wireless asset inventory. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
AN2124 Analytic 2124
Real-time monitoring identifies a process executing iwconfig or ip link set promisc, or loading mac80211 monitor mode, on an Industrial Control System (ICS) Linux asset outside normal configuration management activity. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
AN2269 Analytic 2269
Real-time monitoring identifies a Windows process enabling promiscuous or monitor mode on a wireless adapter (netsh wlan, WinPcap/Npcap driver load, etc.) on an Industrial Control System (ICS) workstation that is not a designated wireless management station, indicating preparation for wireless interception consistent with this technique's reconnaissance phase. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
No reviewed association in this snapshot.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.