MITRE ATT&CKtechnique
T0829 Loss of View
- Domain
- ics
- Tactics
- Impact
- Platforms
- None
- Version
- 1.0
- Created
- 2020-05-21
Description
Adversaries may cause a sustained or permanent loss of view where the ICS equipment will require local, hands-on operator intervention; for instance, a restart or manual operation. By causing a sustained reporting or visibility loss, the adversary can effectively hide the present state of operations. This loss of view can occur without affecting the physical processes themselves.
Related
Tactic · MITRE ATT&CK (1)
- TA0105 Impact tactic
Referenced by MITRE ATT&CK · mitigates (3)
Referenced by MITRE ATT&CK · uses (9)
- C0066 2026 U.S. Water Utilities Attacks campaign
- C0063 2025 Poland Wiper Attacks campaign
- C0041 FrostyGoop Incident campaign
- S1157 Fuxnet software (malware)
- C0031 Unitronics Defacement Campaign campaign
- G1027 CyberAv3ngers group
- S0607 KillDisk software (malware)
- S0604 Industroyer software (malware)
- S0372 LockerGoga software (malware)
References
- https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf Corero
- https://icscsi.org/library/Documents/White_Papers/SANS%20-%20ICS%20Cyber%20Kill%20Chain.pdf Michael J. Assante and Robert M. Lee
- https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false Tyson Macaulay