Home >
ICS >
Participants >
Claroty >
Collection (TA0100)
|
|
TRITON |
||||
Step | ATT&CK Pattern |
|
||
9.D.2
|
Technique Detect Operating Mode (T0868) |
|
||
16.C.2
|
Technique Detect Operating Mode (T0868) |
|
||
20.A.2
|
Technique Detect Operating Mode (T0868) |
|
||
20.D.2
|
Technique Detect Operating Mode (T0868) |
|
||
24.A.2
|
Technique Detect Operating Mode (T0868) |
|
Criteria
Evidence of an adversary initiated Get Attribute Single CIP request for the "Status" attribute (attribute 0x05, instance 0x01, class 0x01) of the control PLC (10.0.100.110).
Criteria
Evidence of an adversary initiated Get Attribute Single CIP request for the "Status" attribute (attribute 0x05, instance 0x01, class 0x01) of the safety PLC (10.0.100.105).
Criteria
Evidence of an adversary initiated Get Attribute Single CIP request for the "Status" attribute (attribute 0x05, instance 0x01, class 0x01) of the control PLC (10.0.100.110).