Pipedream Malware Continues to Shred Industrial Systems

PipedreamDragosIndustrial Control SystemICSChernoviteIncontroller

In 2022, the Chernovite threat group created Pipedream, a new modular malware designed to attack Industrial Control Systems (ICS). This powerful toolset has the potential to launch devastating and devastating attacks on tens of thousands of critical industrial devices.

APT Groups

CHERNOVITE

Russian Federation

Notes

<div>CONCLUSIONS</div><div>SOCRadar’s Vulnerability Intelligence provides detailed vulnerability information and updates about the latest exploitation trends. Having visibility into company vulnerabilities enables you to prioritize patches, effectively strengthening your organization’s overall security posture better.</div><div>As the hackers threaten to publish the company’s confidential data to the internet, only<a href="https://platform.socradar.com/app/threatfeed/vulnerabilities"> Vulnerability İntellegence</a> can prevent this data leakage, as confidential data is protected independently of the exposure.</div><div> </div>

Mitigation

<div>Mitigations</div><div> </div><div>TTPs <div> <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dee2e6 1.5pt;border-top:solid #dfdfdf 0.75pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Name</td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dee2e6 1.5pt;border-top:solid #dfdfdf 0.75pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Description</td></tr><tr style="height:43pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dee2e6 1.5pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">PIPEDREAM</td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dee2e6 1.5pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[3]</a><a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr></tbody></table></div> INCONTROLLER is custom malware that includes multiple modules tailored towards ICS devices and technologies, including Schneider Electric and Omron PLCs as well as OPC UA, Modbus, and CODESYS protocols. INCONTROLLER has the ability to discover specific devices, download logic on the devices, and exploit platform-specific vulnerabilities. As of September 2022, some security researchers assessed INCONTROLLER was developed by CHERNOVITE.[1][2][3][4][5] <div style="line-height: 1.44; margin-top: 0pt; margin-bottom: 4pt;"><span style="color: rgb(57, 67, 76); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Techniques Used</div><div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Domain</td><td colspan="2" style="border-width: 0.75pt 0.75pt 1.5pt; border-style: solid; border-color: rgb(223, 223, 223) rgb(223, 223, 223) rgb(222, 226, 230); vertical-align: bottom; padding: 5pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dee2e6 1.5pt;border-top:solid #dfdfdf 0.75pt;vertical-align:bottom;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Name</td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dee2e6 1.5pt;border-top:solid #dfdfdf 0.75pt;vertical-align:bottom;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Use</td></tr><tr style="height:43.5pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dee2e6 1.5pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dee2e6 1.5pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0858"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0858</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dee2e6 1.5pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0858"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Change Operating Mode</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dee2e6 1.5pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can establish a remote HTTP connection to change the operating mode of Omron PLCs.<a href="https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[3]</a><a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:70.5pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0884"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0884</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0884"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Connection Proxy</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">The <a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> PLCProxy module can add an IP route to the CODESYS gateway running on Schneider PLCs to allow it to route messages through the PLC to other devices on that network. This allows the malware to bypass firewall rules that prevent it from directly communicating with devices on the same network as the PLC.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:43.5pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0809"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0809</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0809"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Data Destruction</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can wipe the memory of Omron PLCs and reset settings through the remote HTTP service.<a href="https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[2]</a><a href="https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[3]</a><a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0890"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0890</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0890"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Exploitation for Privilege Escalation</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> has the ability to exploit a vulnerable Asrock driver (AsrDrv103.sys) using CVE-2020-15368 to load its own unsigned driver on the system.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:43.5pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0891"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0891</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0891"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Hardcoded Credentials</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can login to Omron PLCs using hardcoded credentials, which is documented in CVE-2022-34151.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:43.5pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0867"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0867</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0867"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Lateral Tool Transfer</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can use a Telnet session to load a malware implant on Omron PLCs.<a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[1]</a><a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:43.5pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0836"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0836</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0836"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Modify Parameter</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can use the HTTP CGI scripts on Omron PLCs to modify parameters on EtherCat connected servo drives.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:29.25pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0842"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0842</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0842"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Network Sniffing</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can deploy Tcpdump to sniff network traffic and collect PCAP files.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:43.5pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0861"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0861</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0861"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Point & Tag Identification</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can remotely read the OCP UA structure from devices.<a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[1]</a></td></tr><tr style="height:69pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0843"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0843</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0843"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Program Download</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can use the CODESYS protocol to download programs to Schneider PLCs.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a><a href="https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[2]</a><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can modified program logic on Omron PLCs using either the program download or backup transfer functions available through the HTTP server.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:69pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0845"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0845</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0845"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Program Upload</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can use the CODESYS protocol to upload programs from Schneider PLCs.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a><a href="https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[2]</a><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can obtain existing program logic from Omron PLCs by using either the program upload or backup functions available through the HTTP server.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:96.75pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0886"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0886</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0886"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Remote Services</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can use the CODESYS protocol to remotely connect to Schneider PLCs and perform maintenance functions on the device.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can use Telnet to upload payloads and execute commands on Omron PLCs. <a href="https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[2]</a><a href="https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[3]</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> The malware can also use HTTP-based CGI scripts (e.g., cpu.fcgi, ecat.fcgi) to gain administrative access to the device.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:122.25pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0846"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0846</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0846"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Remote System Discovery</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can perform a UDP multicast scan of UDP port 27127 to identify Schneider PLCs that use that port for the NetManage protocol.<a href="https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[3]</a><a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can use the FINS (Factory Interface Network Service) protocol to scan for and obtain MAC address associated with Omron devices.<a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[1]</a><a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> has the ability to perform scans for TCP port 4840 to identify devices running OPC UA servers.<a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0888"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0888</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0888"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Remote System Information Discovery</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> includes a library that creates Modbus connections with a device to request its device ID.<a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[1]</a><a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0869"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0869</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0869"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Standard Application Layer Protocol</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can remotely send commands to a malicious agent uploaded on Omron PLCs over HTTP or HTTPS.<a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[1]</a></td></tr><tr style="height:57pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0855"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0855</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0855"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Unauthorized Command Message</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can send custom Modbus commands to write register values on Schneider PLCs.<a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[1]</a><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can send write tag values on OPC UA servers.<a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[1]</a></td></tr><tr style="height:82.5pt;"><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">ICS</td><td colspan="2" style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0859"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0859</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T0859"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Valid Accounts</a></td><td style="border-left:solid #dfdfdf 0.75pt;border-right:solid #dfdfdf 0.75pt;border-bottom:solid #dfdfdf 0.75pt;border-top:solid #dfdfdf 0.75pt;vertical-align:top;padding:8pt 8pt 8pt 8pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can brute force password-based authentication to Schneider PLCs over the CODESYS protocol (UDP port 1740).<a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[1]</a><a href="https://attack.mitre.org/software/S1045"><span style="font-size: 12pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">INCONTROLLER</a><span style="font-size: 12pt; font-family: Arial; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;"> can perform brute force guessing of passwords to OPC UA servers using a predefined list of passwords.<a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[1]</a><a href="https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"><span style="font-size: 9pt; font-family: Arial; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">[5]</a></td></tr></tbody></table></div> <h2 style="line-height:1.5999959999999998;background-color:#f3f3f8;margin-top:0pt;margin-bottom:4pt;padding:18pt 0pt 0pt 0pt;"><span style="font-size: 17pt; font-family: Arial; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Appendix: MITRE ATT&CK for ICS Mapping</h2><div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:35.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Module</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Tactic</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Technique</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Execution</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0807: Command-Line Interface</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Execution</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0853: Scripting</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Lateral Movement</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0859: Valid Accounts</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Discovery</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0888: Remote System Information Discovery</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Discovery</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0846: Remote System Discovery</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Persistence</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0859: Valid Accounts</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Collection</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0801: Monitor Process State</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Collection</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0861: Point & Tag Identification</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Command and Control</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0885: Commonly Used Port</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Command and Control</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0869: Standard Application Layer Protocol</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0832: Manipulation of View</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">TAGRUN</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0882: Theft of Operational Information</td></tr></tbody></table></div> <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:35.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Module</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Tactic</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Technique</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Execution</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0807: Command-Line Interface</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Execution</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0853: Scripting</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Persistence</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0859: Valid Accounts</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Persistence</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0857: System Firmware</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Persistence</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0889: Modify Program</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Discovery</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0846: Remote System Discovery</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Discovery</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0888: Remote System Information Discovery</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Lateral Movement</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0812: Default Credentials</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Lateral Movement</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0843: Program Download</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Lateral Movement</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0859: Valid Accounts</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Collection</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0801: Monitor Process State</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Collection</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0845: Program Upload</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Collection</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0801: Monitor Process State</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Command and Control</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0885: Commonly Used Port</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Command and Control</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0869: Standard Application Layer Protocol</td></tr><tr style="height:75.75pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Inhibit Response Function</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0804: Block Reporting Message</td></tr><tr style="height:75.75pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Inhibit Response Function</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0803: Block Command Message</td></tr><tr style="height:75.75pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Inhibit Response Function</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0814: Denial of Service</td></tr><tr style="height:75.75pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Inhibit Response Function</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0809: Data Destruction</td></tr><tr style="height:75.75pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Inhibit Response Function</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0816: Device Restart/Shutdown</td></tr><tr style="height:75.75pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Inhibit Response Function</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0857: System Firmware</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impair Process Control</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0836: Modify Parameter</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impair Process Control</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0855: Unauthorized Command Message</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0813: Denial of Control</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0815: Denial of View</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0826: Loss of Availability</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0827: Loss of Control</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0828: Loss of Productivity and Revenue</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0831: Manipulation of Control</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">CODECALL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0882: Theft of Operational Information</td></tr></tbody></table></div> <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:35.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Module</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Tactic</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Technique</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Initial Access</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0886: Remote Services</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Execution</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0807: Command-Line Interface</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Execution</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0853: Scripting</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Execution</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0858: Change Operating Mode</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Execution</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0821: Modify Controller Tasking</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Execution</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0834: Native API</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Persistence</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0889: Modify Program</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Persistence</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0859: Valid Accounts</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Evasion</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0858: Change Operating Mode</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Discovery</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0842: Network Sniffing</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Discovery</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0846: Remote System Discovery</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Discovery</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0888: Remote System Information Discovery</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Lateral Movement</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0812: Default Credentials</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Lateral Movement</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0867: Lateral Tool Transfer</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Lateral Movement</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0843: Program Download</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Lateral Movement</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0886: Remote Services</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Lateral Movement</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0859: Valid Accounts</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Collection</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0868: Detect Operating Mode</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Collection</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0801: Monitor Process State</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Collection</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0845: Program Upload</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Command and Control</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0885: Commonly Used Port</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Command and Control</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0869: Standard Application Layer Protocol</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Inhibit Response Function</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0881: Service Stop</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impair Process Control</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0836: Modify Parameter</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impair Process Control</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0855: Unauthorized Command Message</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0879: Damage to Property</td></tr><tr style="height:36pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0837: Loss of Safety</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0831: Manipulation of Control</td></tr><tr style="height:56.25pt;"><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">OMSHELL</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">Impact</td><td style="border-bottom: 0.75pt solid rgb(213, 212, 218); border-top: 0.75pt solid rgb(213, 212, 218); vertical-align: top; padding: 8pt; overflow: hidden; overflow-wrap: break-word;"><span style="font-size: 12pt; font-family: Arial; color: rgb(9, 5, 22); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; vertical-align: baseline;">T0882: Theft of Operational Information</td></tr></tbody></table></div> </div></div><div> </div>