C0020: Maroochy Water Breach
MITRE ATT&CK C0020: Maroochy Water Breach Campaign details, with detection guidance, relationships and mapped CVEs.
Security context for executives and security teams
The Maroochy Water Breach is a concrete ICS example of cyber activity becoming a public-service and environmental incident: misuse of a wastewater control system and stolen engineering equipment led to release of 800,000 liters of raw sewage. For leaders, the decision value is that OT security is not only an IT risk; loss of operator visibility, loss of control, unauthorized commands, alarm manipulation, wireless access, remote services, and transient engineering assets can directly affect community services and physical outcomes.
Executive priority
Prioritize this as an operational resilience and cyber-physical risk case study. Executives should ask whether wastewater, utilities, or other control environments can prove who can remotely or wirelessly interact with control assets, whether engineering equipment is inventoried and access-controlled, whether alarms and reporting data are trustworthy, and whether incident response plans include physical-process safety, environmental reporting, and continuity decisions. It also supports audit and compliance evidence around remote access governance, OT asset control, alarm integrity, and response readiness.
Technical view
ATT&CK provides no official detection text, platforms, or tactics for this campaign, so validation should be relationship-driven. SOC, OT, and IR teams should test visibility and controls around the mapped behaviors: Denial of Control, Denial of View, External Remote Services, Modify Parameter, Modify Alarm Settings, Rogue Master, Wireless Compromise, Transient Cyber Asset, Alarm Suppression, Damage to Property, unauthorized Command Messages, and spoofed Reporting Messages. Focus on whether operators can detect unexpected command traffic, altered process parameters, alarm configuration changes, reporting inconsistencies, unapproved remote access, wireless communications, and use of engineering devices that move between environments.
Likely telemetry
- OT network traffic showing command messages, reporting messages, and communication paths between masters, outstations, controllers, and operator systems
- Remote access authentication and session logs for externally reachable services used to administer or support control systems
- Wireless communication monitoring or radio/network logs where wireless control-system connectivity exists
- Engineering workstation and transient asset inventory, connection history, and configuration-change records
- Controller, SCADA, historian, and HMI logs for parameter changes, alarm-setting changes, alarm suppression, and operator visibility/control loss
Detection direction
- Because MITRE provides no detection guidance for this campaign, first validate whether required OT telemetry is collected, retained, time-synchronized, and reviewable by both SOC and operations teams.
- Correlate control commands with authorized operators, expected engineering assets, approved maintenance windows, and process preconditions; investigate command messages that lack a legitimate operational context.
- Monitor for changes to parameters, alarm settings, and alarm suppression states, especially when paired with remote access, wireless access, or transient engineering equipment use.
- Compare reporting messages and HMI/historian values against independent process indicators where available to identify possible spoofed or misleading status data.
- Tune carefully with operations input: engineering maintenance, testing, communications outages, and legitimate alarm changes can resemble suspicious behavior without process context.
Mitigation priorities
- Establish governance for all remote and wireless access paths into control environments, including approval, authentication, logging, and periodic review.
- Maintain a controlled inventory of engineering equipment and transient cyber assets; restrict and record when they connect to ICS networks.
- Protect integrity of alarm settings, process parameters, and command/reporting paths with change control, role-based access, and independent review for safety-critical functions.
- Segment and monitor ICS communications so unauthorized masters, unexpected command sources, and abnormal reporting behavior are easier to identify.
- Create OT incident response procedures that join SOC, engineering, operations, legal/compliance, and public-safety or environmental response stakeholders where relevant.
Additional notes and limits
This object is a campaign in the ICS ATT&CK domain, not a generic enterprise intrusion pattern. Its value is strongest as a cyber-physical risk and control-validation case: it links unauthorized interaction with control systems to loss of control/view, alarm manipulation, command/reporting abuse, and physical damage outcomes. The supplied relationship set should drive defensive assessments more than the campaign description alone.
The supplied ATT&CK object does not specify platforms, tactics, labels, or official detection guidance. The assessment should not be treated as evidence of current exploitation or applicability to every ICS environment. Local architecture, remote access design, wireless use, engineering asset practices, and process-safety requirements are required to determine actual exposure and monitoring coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Maroochy Water Breach
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| ICS | T1692.002 | Reporting MessageSub-technique | This object uses Reporting Message. |
| ICS | T0822 | External Remote Services | This object uses External Remote Services. |
| ICS | T0838 | Modify Alarm Settings | This object uses Modify Alarm Settings. |
| ICS | T1692.001 | Command MessageSub-technique | This object uses Command Message. |
| ICS | T0864 | Transient Cyber Asset | This object uses Transient Cyber Asset. |
| ICS | T0879 | Damage to Property | This object uses Damage to Property. |
| ICS | T0836 | Modify Parameter | This object uses Modify Parameter. |
| ICS | T0813 | Denial of Control | This object uses Denial of Control. |
| ICS | T0860 | Wireless Compromise | This object uses Wireless Compromise. |
| ICS | T0848 | Rogue Master | This object uses Rogue Master. |
| ICS | T0878 | Alarm Suppression | This object uses Alarm Suppression. |
| ICS | T0815 | Denial of View | This object uses Denial of View. |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 6cf19284e578… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Marshall Abrams July 2008
Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27
Open source URL - [2]mitre-attackC0020Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.