MITRE ATT&CKtechnique

T0801 Monitor Process State

Published 2020-05-21 Modified 2026-10-13 Official page ↗
Domain
ics
Tactics
Collection
Platforms
Embedded, Windows, Linux, Network Devices
Version
1.0
Created
2020-05-21

Description

Adversaries may gather information about the physical process state. This information may be used to gain more information about the process itself or used as a trigger for malicious actions. The sources of process state information may vary such as, OPC tags, historian data, specific PLC block information, or network traffic.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M0816 Mitigation Limited or Not Effective mitigation

Referenced by MITRE ATT&CK · uses (4)

  • S1165 FrostyGoop software (malware)
  • S1072 Industroyer2 software (malware)
  • S0604 Industroyer software (malware)
  • S0603 Stuxnet software (malware)