MITRE ATT&CKtechnique
T0816 Device Restart/Shutdown
- Domain
- ics
- Tactics
- Inhibit Response Function
- Platforms
- Embedded, Windows, Linux, Network Devices
- Version
- 1.1
- Created
- 2020-05-21
Description
Adversaries may forcibly restart or shutdown a device in an ICS environment to disrupt and potentially negatively impact physical processes. Methods of device restart and shutdown exist in some devices as built-in, standard functionalities. These functionalities can be executed using interactive device web interfaces, CLIs, and network protocol commands.
Unexpected restart or shutdown of control system devices may prevent expected response functions happening during critical states.
A device restart can also be a sign of malicious device modifications, as many updates require a shutdown in order to take effect.
Related
Tactic · MITRE ATT&CK (1)
- TA0107 Inhibit Response Function tactic
Referenced by MITRE ATT&CK · mitigates (9)
- M0800 Authorization Enforcement mitigation
- M0801 Access Management mitigation
- M0802 Communication Authenticity mitigation
- M0804 Human User Authentication mitigation
- M0937 Filter Network Traffic mitigation
- M0942 Disable or Remove Feature or Program mitigation
- M0807 Network Allowlists mitigation
- M0930 Network Segmentation mitigation
- M0813 Software Process and Device Authentication mitigation