Block Communications: Wi-Fi

Other sub-techniques of Block Communications (3)

ID	Name
T1695.001	Serial COM
T1695.002	Ethernet
T1695.003	Wi-Fi

Adversaries may block access to Wi-Fi communications to prevent messages from reaching target systems and devices. Wi-Fi connections allow for communications between IT and OT systems and devices. Blocking Wi-Fi communications may also block command and reporting messages.^[1]

An adversary may block Wi-Fi communications by disabling network interfaces, Service Stop, conducting an Adversary-in-the-Middle attack and dropping the network traffic, or by jamming the Wi-Fi signal.

ID: T1695.003

Sub-technique of: T1695

ⓘ

Tactic: Inhibit Response Function

ⓘ

Platforms: Embedded, Linux, Network Devices, Windows

Version: 1.0

Created: 20 April 2026

Last Modified: 13 October 2026

Procedure Examples

ID	Name	Description
S0372	LockerGoga	LockerGoga has disabled all the network interfaces on the system via netsh.exe to include Wi-Fi.^[2]^[3]^[4]

Targeted Assets

ID	Asset
A0008	Application Server
A0007	Control Server
A0009	Data Gateway
A0006	Data Historian
A0017	Distributed Control System (DCS) Controller
A0013	Field I/O
A0016	Firewall
A0002	Human-Machine Interface (HMI)
A0005	Intelligent Electronic Device (IED)
A0012	Jump Host
A0018	Programmable Automation Controller (PAC)
A0003	Programmable Logic Controller (PLC)
A0004	Remote Terminal Unit (RTU)
A0014	Routers
A0010	Safety Controller
A0015	Switch
A0011	Virtual Private Network (VPN) Server
A0001	Workstation

Mitigations

ID	Mitigation	Description
M0807	Network Allowlists	Implement network allowlists to minimize network access to only authorized hosts.
M0930	Network Segmentation	Segment operational networks to isolate critical systems and devices that do not require broad network access.
M0810	Out-of-Band Communications Channel	Ensure systems and devices have an alternative method for communicating in the event that Wi-Fi communication channels become unavailable.

Detection Strategy

ID	Name	Analytic ID	Analytic Description
DET0912	Detection of Block Wi-Fi	AN2055	Real-time monitoring identifies wireless controller management log entries showing Service Set Identifier (SSID) or Media Access Control (MAC) address filter configuration changes for the Industrial Control System (ICS) wireless network from an account not in the authorized wireless admins. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
		AN2166	Real-time monitoring identifies hostapd or wireless controller configuration changes on Linux-based access points disabling the Industrial Control System (ICS) wireless Service Set Identifier (SSID), by a User Identifier (UID) not in the authorized wireless admin UIDs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
		AN2205	Real-time monitoring identifies a mass deauthentication event targeting multiple enrolled Industrial Control System (ICS) wireless devices simultaneously, or a wireless access point configuration change excluding enrolled device Media Access Control (MAC) address from the association list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
		AN2252	Real-time monitoring identifies deauthentication frames targeting enrolled Industrial Control System (ICS) wireless device Media Access Control (MAC) address from a source not in the approved wireless infrastructure. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.