MITRE ATT&CK® Matrix
ICS ATT&CK Matrix
A Glexia-styled visualization of ATT&CK tactics and techniques. This is not the MITRE Navigator UI and does not imply MITRE endorsement.
Collection
11 techniques
T0801Monitor Process StateEmbedded, WindowsT0802Automated CollectionEmbedded, WindowsT0811Data from Information RepositoriesEmbedded, WindowsT0830Adversary-in-the-MiddleEmbedded, WindowsT0845Program UploadEmbeddedT0852Screen CaptureEmbedded, WindowsT0861Point & Tag IdentificationEmbedded, WindowsT0868Detect Operating ModeEmbeddedT0877I/O ImageEmbeddedT0887Wireless SniffingEmbedded, WindowsT0893Data from Local SystemEmbedded, Windows
Command and Control
5 techniques
Discovery
8 techniques
T0840Network Connection EnumerationEmbedded, WindowsT0842Network SniffingEmbedded, WindowsT0846Remote System DiscoveryEmbedded, WindowsT0846.001Port ScanEmbedded, WindowsT0846.002Broadcast DiscoveryEmbedded, WindowsT0846.003Multicast DiscoveryEmbedded, WindowsT0887Wireless SniffingEmbedded, WindowsT0888Remote System Information DiscoveryEmbedded, Windows
Evasion
9 techniques
T0820Exploitation for EvasionEmbedded, WindowsT0849MasqueradingEmbedded, WindowsT0851RootkitEmbedded, WindowsT0858Change Operating ModeEmbeddedT0872Indicator Removal on HostEmbedded, WindowsT0894System Binary Proxy ExecutionEmbedded, WindowsT1692Unauthorized MessageEmbedded, WindowsT1692.001Command MessageEmbedded, WindowsT1692.002Reporting MessageEmbedded, Windows
Execution
15 techniques
T0821Modify Controller TaskingEmbeddedT0823Graphical User InterfaceEmbedded, WindowsT0834Native APIEmbedded, WindowsT0858Change Operating ModeEmbeddedT0863User ExecutionEmbedded, WindowsT0871Execution through APIEmbedded, WindowsT0874HookingEmbedded, WindowsT0895Autorun ImageEmbedded, WindowsT1701Command and Scripting InterpreterICST1701.001PowerShellICST1701.002Windows Command ShellICST1701.003Unix ShellICST1701.004Visual BasicICST1701.005PythonICST1701.006JavaScriptICS
Impact
12 techniques
T0813Denial of ControlNoneT0815Denial of ViewNoneT0826Loss of AvailabilityNoneT0827Loss of ControlNoneT0828Loss of Productivity and RevenueNoneT0829Loss of ViewNoneT0831Manipulation of ControlNoneT0832Manipulation of ViewNoneT0837Loss of ProtectionNoneT0879Damage to PropertyNoneT0880Loss of SafetyNoneT0882Theft of Operational InformationNone
Impair Process Control
8 techniques
T0806Brute Force I/OEmbedded, WindowsT0836Modify ParameterEmbedded, WindowsT1692Unauthorized MessageEmbedded, WindowsT1692.001Command MessageEmbedded, WindowsT1692.002Reporting MessageEmbedded, WindowsT1693Modify FirmwareEmbeddedT1693.001System FirmwareEmbedded, WindowsT1693.002Module FirmwareEmbedded
Inhibit Response Function
20 techniques
T0800Activate Firmware Update ModeEmbedded, WindowsT0809Data DestructionEmbedded, WindowsT0814Denial of ServiceEmbedded, WindowsT0816Device Restart/ShutdownEmbedded, WindowsT0835Manipulate I/O ImageEmbeddedT0838Modify Alarm SettingsEmbedded, WindowsT0851RootkitEmbedded, WindowsT0878Alarm SuppressionEmbedded, WindowsT0881Service StopEmbedded, WindowsT0892Change CredentialEmbedded, WindowsT1691Block Operational Technology MessageEmbedded, WindowsT1691.001Command MessageEmbedded, WindowsT1691.002Reporting MessageEmbedded, WindowsT1693Modify FirmwareEmbeddedT1693.001System FirmwareEmbedded, WindowsT1693.002Module FirmwareEmbeddedT1695Block CommunicationsEmbedded, WindowsT1695.001Serial COMEmbedded, WindowsT1695.002EthernetEmbedded, WindowsT1695.003Wi-FiEmbedded, Windows
Initial Access
12 techniques
T0817Drive-by CompromiseWindows, LinuxT0819Exploit Public-Facing ApplicationEmbedded, WindowsT0822External Remote ServicesEmbedded, WindowsT0847Replication Through Removable MediaEmbedded, WindowsT0848Rogue MasterEmbedded, WindowsT0860Wireless CompromiseEmbedded, WindowsT0862Supply Chain CompromiseEmbedded, WindowsT0864Transient Cyber AssetWindows, LinuxT0865Spearphishing AttachmentEmbedded, WindowsT0866Exploitation of Remote ServicesEmbedded, WindowsT0883Internet Accessible DeviceEmbedded, WindowsT0886Remote ServicesEmbedded, Windows
Lateral Movement
11 techniques
T0843Program DownloadEmbeddedT0843.001Download AllEmbeddedT0843.002Online EditEmbeddedT0843.003Program AppendEmbeddedT0859Valid AccountsEmbedded, WindowsT0866Exploitation of Remote ServicesEmbedded, WindowsT0867Lateral Tool TransferEmbedded, WindowsT0886Remote ServicesEmbedded, WindowsT1694Insecure CredentialsEmbedded, WindowsT1694.001Default CredentialsEmbedded, WindowsT1694.002Hardcoded CredentialsEmbedded
Persistence
10 techniques
T0859Valid AccountsEmbedded, WindowsT0873Project File InfectionWindows, LinuxT0873.001Siemens Project File FormatWindows, LinuxT0889Modify ProgramEmbeddedT1693Modify FirmwareEmbeddedT1693.001System FirmwareEmbedded, WindowsT1693.002Module FirmwareEmbeddedT1694Insecure CredentialsEmbedded, WindowsT1694.001Default CredentialsEmbedded, WindowsT1694.002Hardcoded CredentialsEmbedded
Privilege Escalation
2 techniques
Exports
Structured JSON, CSV, and Navigator-layer export generation will use the normalized reference records after full sync. The current page is intentionally lightweight and source-backed.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.
