Analytic 1856

Real-time network monitoring identifies a sustained spike in malformed or high-volume Industrial Control System (ICS) protocol traffic directed at a single field device from a source not in the approved control server list, immediately followed by that device dropping out of the supervisory poll cycle. Documented precedent: Sandworm's Industroyer malware sent a crafted 18-byte proprietary User Datagram Protocol (UDP) packet to port 50000 on Siemens Protection Technology (SIPROTEC) relays (CVE-2015-5374), causing the device to hang and require a manual reboot. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

3. Relaterade regleringar

Länkade ärenden

• MITREATTACK -

  © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. https://attack.mitre.org/

  Terms of Use

  LICENSE

  The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK^® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

  "© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

  DISCLAIMERS

  MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by ATT&CK.

  ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

  See our FAQ for more information on how to use and represent the ATT&CK name.