Open Access

Jaafer Rahmani, Axel Sikora

• This paper presents a novel approach to applying the MITRE ATT&CK framework, traditionally used for IT cybersecurity, to industrial OT networks. The MITRE ATT&CK framework is a widely adopted knowledge base that systematically categorizes adversarial tactics and techniques used in network-based cyber attacks. To the best of our knowledge, this paper respresents the first mapping of the MITREThis paper presents a novel approach to applying the MITRE ATT&CK framework, traditionally used for IT cybersecurity, to industrial OT networks. The MITRE ATT&CK framework is a widely adopted knowledge base that systematically categorizes adversarial tactics and techniques used in network-based cyber attacks. To the best of our knowledge, this paper respresents the first mapping of the MITRE ATT&CK framework to Modbus-based cyberattacks, implemented on a real hardware-based Industrial OT Network testbed, demonstrating how adversarial techniques manifest in industrial OT network environments. Modbus, a widely used fieldbus protocol, exemplifies the security challenges inherent in legacy industrial communication systems. In our analysis, we propose and describe a methodology to dissect a multi-stage attack, starting from an initial network compromise on an Engineering Workstation, followed by lateral movement to a Human-Machine Interface, and culminating in injection and Denial-of-Service attacks against Programmable Logic Controllers. Our mapping reveals critical vulnerabilities in Modbus and similar fieldbus protocols, supporting the development of tailored countermeasures such as command authentication, network segmentation, and anomaly detection. This work bridges the gap between IT-centric ATT&CK methodologies and industrial OT networks while providing actionable insights for future monitoring and protection activities for threat detection and mitigation.…