This research investigates how adversary techniques in OT/Industrial Control Systems (ICS) environments start and build on each other to create effects. OT attacks often unfold as multi-step attacks where the effect of one technique enables the next. Existing knowledge bases catalogue techniques, but offer limited visibility into causal links, prerequisites, and their effects.
Using the MITRE ATT&CK for ICS framework alongside threat reports, the study will:
- Analyse the causes that lead to the use of specific techniques (such as preconditions, enabling events, and environmental factors).
- Describe the effects those techniques produce (such as changes to system state, process deviations, and impacts on safety or availability).
The main outputs will be:
- A dependency chain model. This will show how techniques depend on each other and how they can be ordered and combined during real-world intrusions.
- A set of causes and effects that are related to techniques.
- Interactive graphs that highlight likely next techniques, breakpoints, and other explainable contexts.