A versioned reference, not a risk score
ICS Technique Explorer
Explore MITRE ATT&CK® for ICS by platform and asset role. Keep the whole system in view, inspect the source filters, and see what changed between releases.
Embedded: a closer view.
Purpose-built controllers and field devices: logic, firmware, operating modes, tasking, and I/O. The underlying OS may be unknown.
No archived page is available for this historical platform view. The selected release provides no active technique tags for these four platform categories; its filtered sets are empty. Use full ICS v18.1 for the historical matrix. Classifications are not backfilled from newer releases.
0 matching IDs of 0 in this parent-aware view0 parents + 0 sub-techniques before search/asset filters
Derived view · archive page unavailableThese are reference memberships, not applicability decisions. This historical platform page returned 404; the view is reconstructed from release tags using the current parent-visibility rule, not an observed archived matrix. A technique can appear under several tactics; aligned rows are not an attack sequence. A matching child keeps its parent visible as labeled context; context is not counted.
No techniques match these filters.
Try another platform, clear the search/asset filters, or review the full ICS matrix. Zero matches does not establish that an asset is safe.
Tip: use Table for a compact list, or scroll the matrix horizontally (keyboard: focus it, then use the arrow keys). Select a technique for its definition, source tags, asset relationships, and citations.
Read the filters critically
Not shown does not mean not applicable.
Platform tags are navigation aids, not four exclusive device bins. These views stay within the ICS domain; they are not the Enterprise Windows, Linux, or Network Devices matrices.
- 82 active IDs have the literal platform value None. They are omitted from the four platform views. Review full ICS for process and business consequences.
- 1 active IDs have no usable platform field. Missing metadata is not an applicability judgment.
- 0 distinct children have direct tags hidden by the parent rule. Switch Membership basis to Direct STIX tags to inspect them; this does not rewrite MITRE’s fields.
- Windows and Linux have identical parent-aware ID sets in v18.1. This reflects source tagging, not identical vulnerabilities, monitoring, or controls.
- Some historical platform pages were unavailable (404). Full ICS was verified against its archived page. Unavailable platform views are explicitly reconstructed with the current parent-aware rule—not claimed to be historical website renderings. This snapshot has no active techniques tagged Embedded, Windows, Linux or Network Devices, so those filtered sets are empty. No platform classification has been backfilled from a newer release.
View counts and affected IDs
| ICS view | Parents | Children | Total IDs | Direct tags | Verification |
|---|---|---|---|---|---|
| ICS | 83 | 0 | 83 | 83 | Archived page matched |
| Embedded | 0 | 0 | 0 | 0 | Derived; no archived platform page |
| Windows | 0 | 0 | 0 | 0 | Derived; no archived platform page |
| Linux | 0 | 0 | 0 | 0 | Derived; no archived platform page |
| Network Devices | 0 | 0 | 0 | 0 | Derived; no archived platform page |
Literal None: T0800, T0801, T0802, T0803, T0804, T0805, T0806, T0807, T0809, T0811, T0812, T0813, T0814, T0815, T0816, T0817, T0819, T0820, T0821, T0822, T0823, T0826, T0827, T0828, T0829, T0830, T0831, T0832, T0834, T0835, T0836, T0837, T0838, T0839, T0840, T0842, T0843, T0845, T0846, T0847, T0848, T0849, T0851, T0852, T0853, T0855, T0856, T0857, T0858, T0859, T0860, T0861, T0862, T0863, T0864, T0865, T0866, T0867, T0868, T0869, T0871, T0872, T0873, T0874, T0877, T0878, T0879, T0880, T0881, T0882, T0883, T0884, T0885, T0886, T0887, T0888, T0889, T0890, T0891, T0892, T0893, T0894.
Missing/empty platforms: T0895.
Take this release with you
Download v18.1
Downloads contain the complete selected release, not your screen’s search/asset filters. XLSX uses active techniques; JSON/CSV also retain revoked and deprecated technique records. The source ZIP preserves every STIX object, available archived matrix pages, provenance, and MITRE’s license. No third-party vendor PDFs are redistributed.
Source collection modified · Retrieved . Retrieval is not continuous synchronization or a lab heartbeat.