Remote Terminal Unit (RTU)

A Remote Terminal Unit (RTU) is a device that typically resides between field devices (e.g., PLCs, IEDs) and control/SCADA servers and supports various communication interfacing and data aggregation functions. RTUs are typically responsible for forwarding commands from the control server and the collection of telemetry, events, and alerts from the field devices. An RTU can be implemented as a dedicated embedded device, as software platform that runs on a hardened/ruggedized computer, or using a custom application program on a PLC.

ID: A0004
ⓘ
Platforms: Embedded, Linux, Windows
Sectors: Electric, General, Water and Wastewater
Version: 1.1
Created: 28 September 2023
Last Modified: 12 May 2026

Techniques

Domain ID Name
ICS T0800 Activate Firmware Update Mode
ICS T0830 Adversary-in-the-Middle
ICS T0878 Alarm Suppression
ICS T1695 Block Communications
.001 Serial COM
.002 Ethernet
.003 Wi-Fi
ICS T1691 Block Operational Technology Message
.001 Command Message
.002 Reporting Message
ICS T0806 Brute Force I/O
ICS T0892 Change Credential
ICS T1701 .001 Command and Scripting Interpreter: PowerShell
.002 Command and Scripting Interpreter: Windows Command Shell
.003 Command and Scripting Interpreter: Unix Shell
.004 Command and Scripting Interpreter: Visual Basic
.005 Command and Scripting Interpreter: Python
.006 Command and Scripting Interpreter: JavaScript
ICS T0885 Commonly Used Port
ICS T0884 Connection Proxy
ICS T0809 Data Destruction
ICS T0814 Denial of Service
ICS T0816 Device Restart/Shutdown
ICS T0871 Execution through API
ICS T0866 Exploitation of Remote Services
ICS T0874 Hooking
ICS T0872 Indicator Removal on Host
ICS T1694 Insecure Credentials
.001 Default Credentials
ICS T0838 Modify Alarm Settings
ICS T1693 .001 Modify Firmware: System Firmware
ICS T0836 Modify Parameter
ICS T0801 Monitor Process State
ICS T0834 Native API
ICS T0840 Network Connection Enumeration
ICS T0842 Network Sniffing
ICS T0861 Point & Tag Identification
ICS T0846 Remote System Discovery
.001 Port Scan
.002 Broadcast Discovery
.003 Multicast Discovery
ICS T0888 Remote System Information Discovery
ICS T0847 Replication Through Removable Media
ICS T0848 Rogue Master
ICS T0881 Service Stop
ICS T0869 Standard Application Layer Protocol
.001 DNS
.002 Publish/Subscribe Protocols
ICS T0862 Supply Chain Compromise
ICS T1692 Unauthorized Message
.001 Command Message
.002 Reporting Message
ICS T0859 Valid Accounts