A versioned reference, not a risk score
ICS Technique Explorer
Explore MITRE ATT&CK® for ICS by platform and asset role. Keep the whole system in view, inspect the source filters, and see what changed between releases.
The whole system first.
Start here for a whole system, cross-platform attack paths, controller behavior, and process consequences.
104 matching IDs of 104 in this parent-aware view78 parents + 26 sub-techniques before search/asset filters
Checked against MITRE’s pageThese are reference memberships, not applicability decisions. A technique can appear under several tactics; aligned rows are not an attack sequence. A matching child keeps its parent visible as labeled context; context is not counted.
Initial Access
12 matching IDs
Execution
15 matching IDs
Persistence
10 matching IDs
Privilege Escalation
2 matching IDs
Evasion
9 matching IDs
Discovery
8 matching IDs
Lateral Movement
11 matching IDs
Collection
11 matching IDs
Command and Control
5 matching IDs
Inhibit Response Function
20 matching IDs
Impair Process Control
8 matching IDs
Impact
12 matching IDs
Tip: use Table for a compact list, or scroll the matrix horizontally (keyboard: focus it, then use the arrow keys). Select a technique for its definition, source tags, asset relationships, and citations.
Read the filters critically
Not shown does not mean not applicable.
Platform tags are navigation aids, not four exclusive device bins. These views stay within the ICS domain; they are not the Enterprise Windows, Linux, or Network Devices matrices.
- 12 active IDs have the literal platform value None. They are omitted from the four platform views. Review full ICS for process and business consequences.
- 9 active IDs have no usable platform field. Missing metadata is not an applicability judgment.
- 3 distinct children have direct tags hidden by the parent rule. Switch Membership basis to Direct STIX tags to inspect them; this does not rewrite MITRE’s fields.
- Windows and Linux have identical parent-aware ID sets in v20.0. This reflects source tagging, not identical vulnerabilities, monitoring, or controls.
View counts and affected IDs
| ICS view | Parents | Children | Total IDs | Direct tags | Verification |
|---|---|---|---|---|---|
| ICS | 78 | 26 | 104 | 104 | Archived page matched |
| Embedded | 62 | 17 | 79 | 79 | Archived page matched |
| Windows | 56 | 12 | 68 | 69 | Archived page matched |
| Linux | 56 | 12 | 68 | 69 | Archived page matched |
| Network Devices | 39 | 7 | 46 | 49 | Archived page matched |
Literal None: T0813, T0815, T0826, T0827, T0828, T0829, T0831, T0832, T0837, T0879, T0880, T0882.
Missing/empty platforms: T0869.001, T0869.002, T1701, T1701.001, T1701.002, T1701.003, T1701.004, T1701.005, T1701.006.
- T1691.002 · Reporting Message: Network Devices.
- T1692.002 · Reporting Message: Network Devices.
- T1693.001 · System Firmware: Windows, Linux, Network Devices.
Take this release with you
Download v20.0
Downloads contain the complete selected release, not your screen’s search/asset filters. XLSX uses active techniques; JSON/CSV also retain revoked and deprecated technique records. The source ZIP preserves every STIX object, available archived matrix pages, provenance, and MITRE’s license. No third-party vendor PDFs are redistributed.
Source collection modified · Retrieved . Retrieval is not continuous synchronization or a lab heartbeat.