| ID | Name |
|---|---|
| T1695.001 | Serial COM |
| T1695.002 | Ethernet |
| T1695.003 | Wi-Fi |
Adversaries may block access to Ethernet communications to prevent instructions or configurations messages from reaching target systems and devices. Ethernet connections allow for communications between IT and OT systems and devices. Blocking Ethernet communications may also block command and reporting messages.[1]
An adversary may block Ethernet communications by disabling network interfaces, Service Stop, or conducting an Adversary-in-the-Middle attack and dropping the network traffic.
| ID | Name | Description |
|---|---|---|
| S0372 | LockerGoga |
LockerGoga had blocked network communications by disabling all the network interfaces on the system via netsh.exe.[2][3][4] |
| ID | Mitigation | Description |
|---|---|---|
| M0807 | Network Allowlists |
Implement network allowlists to minimize network access to only authorized hosts. |
| M0930 | Network Segmentation |
Segment operational networks to isolate critical systems and devices that do not require broad network access. |
| M0810 | Out-of-Band Communications Channel |
Ensure systems and devices have an alternative method for communicating in the event that Ethernet communication channels become unavailable. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0911 | Detection of Block Ethernet | AN2054 |
Real-time monitoring identifies a Windows network-adapter disable or administrative interface-down event on an ICS gateway or protocol-converter host outside the approved network-maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
| AN2165 |
Real-time monitoring identifies ip link set down commands on Industrial Control System (ICS) Linux gateway hosts by a User Identifier (UID) not in the authorized net admin UIDs, affecting the device subnet interface. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
||
| AN2204 |
Real-time monitoring identifies a switch interface transitioning to administratively-down state on a port connected to an Industrial Control System (ICS) field device, from a configuration change source not in the approved network administration list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
||
| AN2214 |
Real-time monitoring identifies device_ip offline alarm coinciding with switch port admin-down syslog for that port, distinguishing deliberate Ethernet blocking from physical disconnection. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |