External Remote Services (T0822)

View on ATT&CK

In Playbook

Technique & Subtechniques

  • External Remote Services

Associated Tactics

  • Initial Access

Initial Access (TA0108)

The adversary is trying to get into your ICS environment. Initial Access consists of techniques that adversaries may use as entry vectors to gain an initial foothold within an ICS environment. These techniques include compromising operational technology assets, IT resources in the OT network, and external remote services and websites. They may also target third party entities and users with privileged access. In particular, these initial access footholds may include devices and communication mechanisms with access to and privileges in both the IT and OT environments. IT resources in the OT environment are also potentially vulnerable to the same attacks as enterprise IT systems. Trusted third parties of concern may include vendors, maintenance personnel, engineers, external integrators, and other outside entities involved in expected ICS operations. Vendor maintained assets may include physical devices, software, and operational equipment. Initial access techniques may also leverage outside devices, such as radios, controllers, or removable media, to remotely interfere with and possibly infect OT operations.

View on ATT&CK

Procedure Examples

Description Source(s)
Daniel Oakley, Travis Smith, Tripwire Retrieved. 2018/05/30 Daniel Oakley, Travis Smith, Tripwire
Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems 2016, March 18 Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case Retrieved. 2018/03/27 Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016