Operational technology communications occur over serial COM, Ethernet, Wi-Fi, cellular (4G/5G), and satellite mediums. Adversaries may block communications to prevent reporting messages and command messages from reaching their intended target devices disrupting processes, operations, and causing cyber-physical impacts.[1]
Adversaries may block communications by either making modifications to software (System Firmware, Module Firmware, Hooking, and Rootkit) and services (Service Stop, Denial of Service) on systems and devices or by positioning themselves between systems and devices and intercepting and blocking the communications such as the case with an Adversary-in-the-Middle attack.
| ID | Name | Description |
|---|---|---|
| G1027 | CyberAv3ngers |
During the 2026 Iranian Water Campaign, CyberAv3ngers locked out operators by changing the PLC’s IP address.[2] |
| ID | Mitigation | Description |
|---|---|---|
| M0807 | Network Allowlists |
Implement network allowlists to minimize network access to only authorized hosts. |
| M0930 | Network Segmentation |
Segment operational networks to isolate critical systems and devices that do not require broad network access. |
| M0810 | Out-of-Band Communications Channel |
Ensure systems and devices have an alternative method for communicating in the event that communication channels become unavailable. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0910 | Detection of Block Communications | AN2053 |
Real-time monitoring identifies a network infrastructure configuration change that results in a communication gap between previously-connected Industrial Control System (ICS) zones, from a source not in the approved network administration list. This technique-level analytic synthesizes Serial COM (T1695.001), Ethernet (T1695.002), and Wi-Fi (T1695.003). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
| AN2164 |
Real-time monitoring identifies iptables/nftables rule additions blocking Industrial Control System (ICS) protocol ports on Linux ICS gateways. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
||
| AN2227 |
Real-time monitoring identifies multiple field devices becoming unreachable simultaneously following a network infrastructure configuration change event. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
||
| AN2267 |
Real-time monitoring identifies Windows firewall rule additions blocking Industrial Control System (ICS) protocol ports on ICS gateway or server hosts. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |