| ID | Name |
|---|---|
| T1691.001 | Command Message |
| T1691.002 | Reporting Message |
Adversaries may block a command message from reaching its intended target to prevent command execution. In OT networks, command messages are sent to provide instructions to control system devices. A blocked command message can inhibit response functions from correcting a disruption or unsafe condition.[1][2]
| ID | Name | Description |
|---|---|---|
| C0028 | 2015 Ukraine Electric Power Attack |
During the 2015 Ukraine Electric Power Attack, Sandworm Team blocked command messages by using malicious firmware to render serial-to-ethernet converters inoperable. [3] |
| S0604 | Industroyer |
In Industroyer the first COM port from the configuration file is used for the actual communication and the two other COM ports are just opened to prevent other processes accessing them. Thus, the IEC 101 payload component is able to take over and maintain control of the RTU device. [4] |
| ID | Mitigation | Description |
|---|---|---|
| M0807 | Network Allowlists |
Utilize network allowlists to restrict unnecessary connections to network devices (e.g., comm servers, serial to ethernet converters) and services, especially in cases when devices have limits on the number of simultaneous sessions they support. |
| M0810 | Out-of-Band Communications Channel |
Provide an alternative method for sending critical command messages to outstations, this could include using radio/cell communication to send messages to a field technician that physically performs the control function. |
| M0814 | Static Network Configuration |
Unauthorized connections can be prevented by statically defining the hosts and ports used for automation protocol connections. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0784 | Detection of Block Command Message | AN1916 |
Real-time monitoring identifies the absence of expected command-message delivery confirmation -- a Supervisory Control and Data Acquisition (SCADA)-issued command that does not produce the expected corresponding state-change response within the normal response latency window, while the device remains reachable for other traffic. Documented in the 2015 Ukraine attack, where Sandworm used malicious firmware to render serial-to-Ethernet converters inoperable. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
| AN2118 |
Real-time monitoring identifies iptables/nftables rule additions on Industrial Control System (ICS) Linux gateways that filter ICS command messages based on content, while allowing other traffic to pass. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
||
| AN2263 |
Real-time monitoring identifies Windows host-based firewall rule modifications or network interface configuration changes on Industrial Control System (ICS) Windows servers that block ICS command-message traffic, coinciding with Supervisory Control and Data Acquisition (SCADA) showing communication loss to field devices. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |