A versioned reference, not a risk score
ICS Technique Explorer
Explore MITRE ATT&CK® for ICS by platform and asset role. Keep the whole system in view, inspect the source filters, and see what changed between releases.
Windows: a closer view.
Windows engineering/operator workstations, OT servers, and actual Windows surfaces. COTS describes sourcing, not an operating system.
68 matching IDs of 68 in this parent-aware view56 parents + 12 sub-techniques before search/asset filters
Checked against MITRE’s pageThese are reference memberships, not applicability decisions. A technique can appear under several tactics; aligned rows are not an attack sequence. A matching child keeps its parent visible as labeled context; context is not counted.
Initial Access
12 matching IDs
Execution
6 matching IDs
Persistence
5 matching IDs
Privilege Escalation
2 matching IDs
Evasion
8 matching IDs
Discovery
8 matching IDs
Lateral Movement
6 matching IDs
Collection
8 matching IDs
Command and Control
3 matching IDs
Inhibit Response Function
16 matching IDs
Impair Process Control
5 matching IDs
Impact
0 matching IDs
Not shown in this platform view. Review full ICS; do not infer immunity.
Tip: use Table for a compact list, or scroll the matrix horizontally (keyboard: focus it, then use the arrow keys). Select a technique for its definition, source tags, asset relationships, and citations.
Read the filters critically
Not shown does not mean not applicable.
Platform tags are navigation aids, not four exclusive device bins. These views stay within the ICS domain; they are not the Enterprise Windows, Linux, or Network Devices matrices.
- 12 active IDs have the literal platform value None. They are omitted from the four platform views. Review full ICS for process and business consequences.
- 9 active IDs have no usable platform field. Missing metadata is not an applicability judgment.
- 3 distinct children have direct tags hidden by the parent rule. Switch Membership basis to Direct STIX tags to inspect them; this does not rewrite MITRE’s fields.
- Windows and Linux have identical parent-aware ID sets in v20.0. This reflects source tagging, not identical vulnerabilities, monitoring, or controls.
View counts and affected IDs
| ICS view | Parents | Children | Total IDs | Direct tags | Verification |
|---|---|---|---|---|---|
| ICS | 78 | 26 | 104 | 104 | Archived page matched |
| Embedded | 62 | 17 | 79 | 79 | Archived page matched |
| Windows | 56 | 12 | 68 | 69 | Archived page matched |
| Linux | 56 | 12 | 68 | 69 | Archived page matched |
| Network Devices | 39 | 7 | 46 | 49 | Archived page matched |
Literal None: T0813, T0815, T0826, T0827, T0828, T0829, T0831, T0832, T0837, T0879, T0880, T0882.
Missing/empty platforms: T0869.001, T0869.002, T1701, T1701.001, T1701.002, T1701.003, T1701.004, T1701.005, T1701.006.
- T1691.002 · Reporting Message: Network Devices.
- T1692.002 · Reporting Message: Network Devices.
- T1693.001 · System Firmware: Windows, Linux, Network Devices.
Take this release with you
Download v20.0
Downloads contain the complete selected release, not your screen’s search/asset filters. XLSX uses active techniques; JSON/CSV also retain revoked and deprecated technique records. The source ZIP preserves every STIX object, available archived matrix pages, provenance, and MITRE’s license. No third-party vendor PDFs are redistributed.
Source collection modified · Retrieved . Retrieval is not continuous synchronization or a lab heartbeat.