T1692.001 Command Message
sub-techniqueICSAdversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an Impact.. An adversary could also misuse control system devices to store data collected from the network for later use. In the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster.
platforms
Platforms this applies to.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (4)
Data components that detect this.
groups (1)
Threat groups associated with this.
software (3)
Malware and tools associated with this.
targets assets (8)
ICS/OT assets this targets.
campaigns (4)
Campaigns that use this.
source
Where this definition is published.