A versioned reference, not a risk score
ICS Technique Explorer
Explore MITRE ATT&CK® for ICS by platform and asset role. Keep the whole system in view, inspect the source filters, and see what changed between releases.
The whole system first.
Start here for a whole system, cross-platform attack paths, controller behavior, and process consequences.
83 matching IDs of 83 in this parent-aware view83 parents + 0 sub-techniques before search/asset filters
Checked against MITRE’s pageThese are reference memberships, not applicability decisions. A technique can appear under several tactics; aligned rows are not an attack sequence. A matching child keeps its parent visible as labeled context; context is not counted.
Initial Access
12 matching IDs
Execution
10 matching IDs
Persistence
6 matching IDs
Privilege Escalation
2 matching IDs
Evasion
7 matching IDs
Discovery
5 matching IDs
Lateral Movement
7 matching IDs
Collection
11 matching IDs
Command and Control
3 matching IDs
Inhibit Response Function
14 matching IDs
Impair Process Control
5 matching IDs
Impact
12 matching IDs
Tip: use Table for a compact list, or scroll the matrix horizontally (keyboard: focus it, then use the arrow keys). Select a technique for its definition, source tags, asset relationships, and citations.
Read the filters critically
Not shown does not mean not applicable.
Platform tags are navigation aids, not four exclusive device bins. These views stay within the ICS domain; they are not the Enterprise Windows, Linux, or Network Devices matrices.
- 82 active IDs have the literal platform value None. They are omitted from the four platform views. Review full ICS for process and business consequences.
- 1 active IDs have no usable platform field. Missing metadata is not an applicability judgment.
- 0 distinct children have direct tags hidden by the parent rule. Switch Membership basis to Direct STIX tags to inspect them; this does not rewrite MITRE’s fields.
- Windows and Linux have identical parent-aware ID sets in v18.1. This reflects source tagging, not identical vulnerabilities, monitoring, or controls.
- Some historical platform pages were unavailable (404). Full ICS was verified against its archived page. Unavailable platform views are explicitly reconstructed with the current parent-aware rule—not claimed to be historical website renderings. This snapshot has no active techniques tagged Embedded, Windows, Linux or Network Devices, so those filtered sets are empty. No platform classification has been backfilled from a newer release.
View counts and affected IDs
| ICS view | Parents | Children | Total IDs | Direct tags | Verification |
|---|---|---|---|---|---|
| ICS | 83 | 0 | 83 | 83 | Archived page matched |
| Embedded | 0 | 0 | 0 | 0 | Derived; no archived platform page |
| Windows | 0 | 0 | 0 | 0 | Derived; no archived platform page |
| Linux | 0 | 0 | 0 | 0 | Derived; no archived platform page |
| Network Devices | 0 | 0 | 0 | 0 | Derived; no archived platform page |
Literal None: T0800, T0801, T0802, T0803, T0804, T0805, T0806, T0807, T0809, T0811, T0812, T0813, T0814, T0815, T0816, T0817, T0819, T0820, T0821, T0822, T0823, T0826, T0827, T0828, T0829, T0830, T0831, T0832, T0834, T0835, T0836, T0837, T0838, T0839, T0840, T0842, T0843, T0845, T0846, T0847, T0848, T0849, T0851, T0852, T0853, T0855, T0856, T0857, T0858, T0859, T0860, T0861, T0862, T0863, T0864, T0865, T0866, T0867, T0868, T0869, T0871, T0872, T0873, T0874, T0877, T0878, T0879, T0880, T0881, T0882, T0883, T0884, T0885, T0886, T0887, T0888, T0889, T0890, T0891, T0892, T0893, T0894.
Missing/empty platforms: T0895.
Take this release with you
Download v18.1
Downloads contain the complete selected release, not your screen’s search/asset filters. XLSX uses active techniques; JSON/CSV also retain revoked and deprecated technique records. The source ZIP preserves every STIX object, available archived matrix pages, provenance, and MITRE’s license. No third-party vendor PDFs are redistributed.
Source collection modified · Retrieved . Retrieval is not continuous synchronization or a lab heartbeat.