Lion Cipher Lab
Map a real OT intrusion with MITRE ATT&CK for ICS: the matrix Enterprise ATT&CK deliberately leaves out
- Threat Intel Analyst
- Intermediate
- Free · no account required
Why it matters
Enterprise ATT&CK — the catalogue most analysts mean when they say 'ATT&CK' — deliberately stops at the edge of the physical process. It will happily describe an attacker phishing a power utility, stealing credentials, and moving laterally across Windows machines, but it has no technique for the thing that actually turns off the lights: sending a command that opens a breaker, or reprogramming the safety controller that is supposed to stop an explosion. That is not an oversight; it is a scope decision, because the GOAL of an OT attack is not data — it is a physical, often safety-critical,…
What you'll learn
- why ICS/OT has its own ATT&CK matrix, separate from Enterprise ATT&CK
- the ICS-specific tactics: Inhibit Response Function, Impair Process Control, Impact
- reading a real OT incident report (the 2015 Ukraine power-grid attack) for its sequence
- mapping an intrusion technique-by-technique across TWO matrices at once
- marking exactly where an intrusion crosses from IT (Enterprise) into OT (ICS)
- understanding that a real ICS intrusion uses BOTH matrices — IT beachhead then OT payload
- distinguishing the Dec 2015 (manual) from the Dec 2016 (Industroyer) Ukraine attacks
- verifying every ATT&CK-for-ICS technique ID on the live matrix before citing it
- chokepoint analysis: which single ICS technique, if detected or blocked, breaks the chain
- the honest limit: refusing to invent technique-level precision a vague report cannot support
Steps in this lab
- The gap: Enterprise ATT&CK stops at the edge of the physical process
- The second matrix: ATT&CK for ICS, and the tactics that only exist here
- When to use which — and why a real OT intrusion always uses BOTH
- Choose the incident — and do NOT conflate the two Ukraine attacks
- Build the table — start with the IT beachhead (Enterprise ATT&CK rows)
- Mark the crossing — the single most important row in the table
- Map the OT payload — the ICS-matrix rows where the process gets hit
- Verify every ID on the live matrix — and refuse to invent precision
- The payoff: chokepoint analysis, and the handoff to OT monitoring
- Why this is the skill, and when NOT to reach for it