This site has been deprecated in favor of https://attack.mitre.org and will remain in place until 11/1/22.
Field Controller/RTU/PLC/IED
Description
Controller terminology depends on the type of system they are associated with. They provide typical processing capabilities. Controllers, sometimes referred to as Remote Terminal Units (RTU) and Programmable Logic Controllers (PLC), are computerized control units that are typically rack or panel mounted with modular processing and interface cards. The units are collocated with the process equipment and interface through input and output modules to the various sensors and controlled devices. Most utilize a programmable logic-based application that provides scanning and writing of data to and from the IO interface modules and communicates with the control system network via various communications methods, including serial and network communications.1
Levels
Notes
Typically programmed in an IEC 61131 programming language, a PLC is designed for real time use in rugged, industrial environments. Connected to sensors and actuators, PLCs are categorized by the number and type of I/O ports they provide and by their I/O scan rate.2
An RTU is a special purpose field device that supports SCADA remote stations with both wired and wireless communication capabilities, in order to communicate with the supervisory controller. Wireless radio is leveraged in remote situations where wired communications are not available; typically with field equipment. This role may also be fulfilled by PLCs with radio communication capabilities. The PLC may still be referred to as an RTU in this case.3
Techniques That Apply
- Activate Firmware Update Mode
- Alarm Suppression
- Automated Collection
- Block Command Message
- Block Reporting Message
- Block Serial COM
- Brute Force I/O
- Change Operating Mode
- Command-Line Interface
- Commonly Used Port
- Data Destruction
- Default Credentials
- Denial of Service
- Detect Operating Mode
- Device Restart/Shutdown
- Execution through API
- Exploitation for Evasion
- I/O Image
- Internet Accessible Device
- Man in the Middle
- Manipulate I/O Image
- Manipulation of View
- Modify Alarm Settings
- Modify Controller Tasking
- Modify Parameter
- Modify Program
- Module Firmware
- Monitor Process State
- Native API
- Network Sniffing
- Program Download
- Program Upload
- Remote System Discovery
- Remote System Information Discovery
- Rootkit
- Supply Chain Compromise
- System Firmware
- Unauthorized Command Message
- Valid Accounts
- Wireless Compromise
