Home >
ICS >
Participants >
Armis >
Detect Operating Mode (T0868)
|
|
TRITON |
||||
Step | ATT&CK Pattern |
|
||
9.D.2
|
Tactic Collection (TA0100) |
|
||
16.C.2
|
Tactic Collection (TA0100) |
|
||
20.A.2
|
Tactic Collection (TA0100) |
|
||
20.D.2
|
Tactic Collection (TA0100) |
|
||
24.A.2
|
Tactic Collection (TA0100) |
|
Criteria
Evidence of an adversary initiated Get Attribute Single CIP request for the "Status" attribute (attribute 0x05, instance 0x01, class 0x01) of the control PLC (10.0.100.110).
Criteria
Evidence of an adversary initiated Get Attribute Single CIP request for the "Status" attribute (attribute 0x05, instance 0x01, class 0x01) of the safety PLC (10.0.100.105).
Criteria
Evidence of an adversary initiated Get Attribute Single CIP request for the "Status" attribute (attribute 0x05, instance 0x01, class 0x01) of the control PLC (10.0.100.110).
Criteria
Evidence of an adversary initiated Get Attribute Single CIP request for the "Status" attribute (attribute 0x05, instance 0x01, class 0x01) of the safety PLC (10.0.100.105).