I/O Image

I/O Image
Technique
ID	T0877
Tactic	Collection
Data Sources	Controller program
Asset	Field Controller/RTU/PLC/IED

Description

Adversaries may seek to capture process image values related to the inputs and outputs of a PLC. Within a PLC all input and output states are stored into an I/O image. This image is used by the user program instead of directly interacting with physical I/O.1

Procedure Examples

Stuxnet copies the input area of an I/O image into data blocks with a one second interval between copies, forming a 21 second recording of the input area. The input area contains information being passed to the PLC from a peripheral. For example, the current state of a valve or the temperature of a device.2

Mitigations

Mitigation Limited or Not Effective - This technique may not be effectively mitigated against, consider controls for assets and processes that lead to the use of this technique.

References

^ Spenneberg, Ralf. (2016). PLC-Blaster. Retrieved June 6, 2019.

^ Nicolas Falliere, Liam O Murchu, Eric Chien. (2011, February). W32.Stuxnet Dossier (Version 1.4). Retrieved September 22, 2017.

v · d · e Adversary Techniques

Initial Access	Data Historian Compromise Drive-by Compromise Engineering Workstation Compromise Exploit Public-Facing Application Exploitation of Remote Services External Remote Services Initial Access Internet Accessible Device Remote Services Replication Through Removable Media Rogue Master Spearphishing Attachment Supply Chain Compromise Wireless Compromise

Execution	Change Operating Mode Command-Line Interface Execution Execution through API Graphical User Interface Hooking Modify Controller Tasking Native API Scripting User Execution

Persistence	Modify Program Module Firmware Persistence Project File Infection System Firmware Valid Accounts

Evasion	Change Operating Mode Evasion Exploitation for Evasion Indicator Removal on Host Masquerading Rootkit Spoof Reporting Message

Discovery	Discovery Network Connection Enumeration Network Sniffing Remote System Discovery Remote System Information Discovery Wireless Sniffing

Lateral Movement	Default Credentials Exploitation of Remote Services Lateral Movement Lateral Tool Transfer Program Download Remote Services Valid Accounts

Collection	Automated Collection Collection Data from Information Repositories Detect Operating Mode I/O Image Man in the Middle Monitor Process State Point & Tag Identification Program Upload Screen Capture Wireless Sniffing

Inhibit Response Function	Activate Firmware Update Mode Alarm Suppression Block Command Message Block Reporting Message Block Serial COM Data Destruction Denial of Service Device Restart/Shutdown Inhibit Response Function Manipulate I/O Image Modify Alarm Settings Rootkit Service Stop System Firmware

Impair Process Control	Brute Force I/O Impair Process Control Modify Parameter Module Firmware Spoof Reporting Message Unauthorized Command Message

Impact	Damage to Property Denial of Control Denial of View Impact Loss of Availability Loss of Control Loss of Productivity and Revenue Loss of Protection Loss of Safety Loss of View Manipulation of Control Manipulation of View Theft of Operational Information

Description

Procedure Examples

Mitigations

References

Navigation menu

Personal tools

Namespaces

Variants

Views

More

Search

ATT&CK™

Questions?

Tools