Nine ICS Technique IDs Stopped Existing

If your ATT&CK for ICS mapping was written in 2020, part of it now points at nothing.

Not because your detection got worse. Because the matrix changed underneath it.

What Changed

The matrix is still twelve tactics. What is new is depth: ICS had no sub-techniques for six years, and now it does.

That is the headline change, and it is a structural one. A flat list of techniques answers "do we cover this". A list with sub-techniques asks a harder question: cover *which part* of it.

The T0 Rule Is Broken

Everybody learned the same shortcut. ICS techniques start with T0, enterprise techniques start with T1.

That shortcut no longer holds. Several ICS techniques now carry T1 identifiers:

• T1691 Block Operational Technology Message
• T1692 Unauthorized Message
• T1693 Modify Firmware
• T1694 Insecure Credentials
• T1695 Block Communications

If you have tooling that filters ICS coverage by matching on a T0 prefix, it is now silently dropping ICS techniques.

IDs You Still See In Decks

These are the mappings that moved:

• T0855 Unauthorized Command Message becomes T1692.001
• T0857 System Firmware becomes T1693.001
• T0812 Default Credentials becomes T1694.001
• T0891 Hardcoded Credentials becomes T1694.002
• T0805 Block Serial COM becomes T1695.001

T0855 in particular appears in a large number of ICS slide decks written since 2021. It is revoked.

Why This Is Not Just Renaming

The old mapping let you say "we cover T0855" and stop there.

The new structure asks which one — a command message, or a reporting message? That is a finer question about what the adversary actually put on the wire, and it is a question your detection either answers or does not.

Sub-techniques make gaps visible that a flat list was hiding. That is uncomfortable and it is the point.

A mapping is a claim about coverage. Claims should be testable.

Try It Yourself

• Check your own mapping against the current matrix at attack.mitre.org — search for the T0 IDs above and see which are marked revoked.
• Grep your detection content and dashboards for T0855, T0812 and T0891. Those three show up most often in inherited OT SIEM rules.
• Test one of them for real: Labshock is a platform for learning and testing OT cybersecurity through hands-on labs and realistic industrial environments. Send an unauthorized command inside a lab, then check whether your rule fires and what ID it reports.
• Start free: github.com/zakharb/labshock · Ask questions: discord.gg/bpmaQFfW76