ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is MITRE's knowledge base for modeling cybersecurity threats based on real-world incidents. It is specifically designed for threats against industrial control environments rather than IT and explains how attackers infiltrate, operate within, and affect industrial systems.
Organizations can use the framework to map their defenses against known tactics and techniques to understand, detect, and mitigate threats across IT and OT environments. It standardizes threat intelligence, supports realistic attack modeling, and prioritizes defenses that protect critical industrial processes and safety functions. It also integrates with other security frameworks such as ISA/IEC 62443, NIST CSF, CIP, and more.
The ATT&CK matrix is a visual table that organizes tactics and techniques.
The ICS matrix covers twelve tactics including Initial Access, Execution, Persistence, Privilege Escalation, Evasion, Discovery, Lateral Movement, Collection, Command and Control, Inhibit Response Function, Impair Process Control, and Impact.
Official resource: MITRE ATT&CK ICS Matrix
The Pyramid of Pain ranks indicator types by how much it hurts an adversary when defenders detect and respond on that indicator. Lower layers are easy for attackers to change; higher layers force them to change behaviour.
| Layer (easier → harder for attacker) | Examples |
|---|---|
| Hash values | MD5 / SHA of a specific malware sample |
| IP addresses | C2 hosts or netblocks (trivial to rotate) |
| Domain names | Malicious domains or subdomains |
| Network artifacts | URI patterns, distinctive User-Agent strings, protocol quirks |
| Host artifacts | Registry keys, dropped paths, service names |
| Tools | Utilities the adversary brings for C2, credential theft or exploitation |
| TTPs | Tactics, techniques and procedures — how they achieve goals end-to-end |
Preventive controls that only denylist hashes or IPs are easy to evade. ATT&CK helps defenders focus higher on the pyramid: map detections and mitigations to techniques that are expensive for the adversary to replace. Use the ICS ATT&CK matrix to prioritise mitigations for process-disruption tactics.