T1691.002 Reporting Message
sub-techniqueICSAdversaries may block or prevent a reporting message from reaching its intended target. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. By blocking these reporting messages, an adversary can potentially hide their actions from an operator. Blocking reporting messages in control systems that manage physical processes may contribute to system impact, causing inhibition of a response function. A control system may not be able to respond in a proper or timely manner to an event, such as a dangerous fault, if its corresponding reporting message is blocked.
platforms
Platforms this applies to.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (5)
Data components that detect this.
software (1)
Malware and tools associated with this.
targets assets (10)
ICS/OT assets this targets.
campaigns (1)
Campaigns that use this.
source
Where this definition is published.