LiveActive security incident?Get immediate response
MITRE ATT&CK® ICS Asset

A0013: Field I/O

Field I/O are devices that communicate with a controller or data aggregator to either send input data or receive output data. Input data may include readings about a given environment/device state from sensors, while output data may include data sent back to actuators for them to either undertake actions or change parameter values.[1] These devices are frequently embedded devices running on lightweight embedded operating systems or RTOSes.

ICSA0013ICS AssetObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

A0013: Field I/O describes Field I/O are devices that communicate with a controller or data aggregator to either send input data or receive output data. Input data may include readings about a given environment/device state from sensors, while output data may include data sent back to actuators for them to either undertake actions or change parameter values.(Citation: Guidance - NIST SP800-82) These devices are frequently embedded devices running on lightweight embedded operating systems or RTOSes.

Executive priority

A0013: Field I/O is an official MITRE ATT&CK ICS asset. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate A0013: Field I/O by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Embedded), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether A0013: Field I/O appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Field I/O

Field I/O are devices that communicate with a controller or data aggregator to either send input data or receive output data. Input data may include readings about a given environment/device state from sensors, while output data may include data sent back to actuators for them to either undertake actions or change parameter values.[1] These devices are frequently embedded devices running on lightweight embedded operating systems or RTOSes.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

28 rows
DomainIDNameRelationship / procedure
ICST0887Wireless SniffingWireless Sniffing targets this object.
ICST1691.001Command MessageSub-techniqueCommand Message targets this object.
ICST0800Activate Firmware Update ModeActivate Firmware Update Mode targets this object.
ICST0814Denial of ServiceDenial of Service targets this object.
ICST0816Device Restart/ShutdownDevice Restart/Shutdown targets this object.
ICST0860Wireless CompromiseWireless Compromise targets this object.
ICST0801Monitor Process StateMonitor Process State targets this object.
ICST0888Remote System Information DiscoveryRemote System Information Discovery targets this object.
ICST1691Block Operational Technology MessageBlock Operational Technology Message targets this object.
ICST0851RootkitRootkit targets this object.
ICST1694Insecure CredentialsInsecure Credentials targets this object.
ICST0809Data DestructionData Destruction targets this object.
ICST1695.001Serial COMSub-techniqueSerial COM targets this object.
ICST1694.001Default CredentialsSub-techniqueDefault Credentials targets this object.
ICST0871Execution through APIExecution through API targets this object.
ICST0862Supply Chain CompromiseSupply Chain Compromise targets this object.
ICST1695.002EthernetSub-techniqueEthernet targets this object.
ICST1694.002Hardcoded CredentialsSub-techniqueHardcoded Credentials targets this object.
ICST1695.003Wi-FiSub-techniqueWi-Fi targets this object.
ICST1691.002Reporting MessageSub-techniqueReporting Message targets this object.
ICST0830Adversary-in-the-MiddleAdversary-in-the-Middle targets this object.
ICST0834Native APINative API targets this object.
ICST0847Replication Through Removable MediaReplication Through Removable Media targets this object.
ICST0859Valid AccountsValid Accounts targets this object.
ICST0884Connection ProxyConnection Proxy targets this object.
ICST0885Commonly Used PortCommonly Used Port targets this object.
ICST0867Lateral Tool TransferLateral Tool Transfer targets this object.
ICST1695Block CommunicationsBlock Communications targets this object.
Relationship explorer

All related ATT&CK context

targets · TechniqueT0887: Wireless SniffingICStargets · TechniqueT1691.001: Command MessageICStargets · TechniqueT0800: Activate Firmware Update ModeICStargets · TechniqueT0814: Denial of ServiceICStargets · TechniqueT0816: Device Restart/ShutdownICStargets · TechniqueT0860: Wireless CompromiseICStargets · TechniqueT0801: Monitor Process StateICStargets · TechniqueT0888: Remote System Information DiscoveryICStargets · TechniqueT1691: Block Operational Technology MessageICStargets · TechniqueT0851: RootkitICStargets · TechniqueT1694: Insecure CredentialsICStargets · TechniqueT0809: Data DestructionICStargets · TechniqueT1695.001: Serial COMICStargets · TechniqueT1694.001: Default CredentialsICStargets · TechniqueT0871: Execution through APIICStargets · TechniqueT0862: Supply Chain CompromiseICStargets · TechniqueT1695.002: EthernetICStargets · TechniqueT1694.002: Hardcoded CredentialsICStargets · TechniqueT1695.003: Wi-FiICStargets · TechniqueT1691.002: Reporting MessageICStargets · TechniqueT0830: Adversary-in-the-MiddleICStargets · TechniqueT0834: Native APIICStargets · TechniqueT0847: Replication Through Removable MediaICStargets · TechniqueT0859: Valid AccountsICS
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
1.1
Created
Modified
Raw hash
9149da9815bd5856...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.21.1Current bundle9149da9815bd…
19.11.1Older bundle9149da9815bd…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Guidance - NIST SP800-82

    Keith Stouffer. (2015, May). Guide to Industrial Control Systems (ICS) Security. Retrieved March 28, 2018.

    Open source URL
  2. [2]
    mitre-attackA0013
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use